remcos | 86f196e6db84218ec0cb4ead59880352b3dfa01d74af93af60347883632f2bf3

General

Target

963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe
Size

482KB
MD5

e061f0c3a1fc124de1ff7e6dd44e6da7
SHA1

a17fa68fef483ae910661e06c0f83d298e70fe15
SHA256

86f196e6db84218ec0cb4ead59880352b3dfa01d74af93af60347883632f2bf3
SHA512

02ec6180f41701e27fb90f32a0294352f9739f186b7a16521d0599f90ae31e28fea82370d7dafd943f915035852a8018b8be88b95374ae607889a0b01333dab8
SSDEEP

6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcN95Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/ZDAcv

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

kelvin654.duckdns.org:14563

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0E35XZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
1660	remcos.exe

Loads dropped DLL 2 IoCs

pid	Process
1240	963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe
1240	963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-0E35XZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-0E35XZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-0E35XZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-0E35XZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	remcos.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1660	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1660	remcos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1660	1240	963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe	28
PID 1240 wrote to memory of 1660	1240	963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe	28
PID 1240 wrote to memory of 1660	1240	963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe	28
PID 1240 wrote to memory of 1660	1240	963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe	28

C:\Users\Admin\AppData\Local\Temp\963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe
"C:\Users\Admin\AppData\Local\Temp\963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1240
- C:\ProgramData\Remcos\remcos.exe
  "C:\ProgramData\Remcos\remcos.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\logs.dat

Filesize
178B

MD5
3e58b9e8f82046dc1eef753b3902eb73

SHA1
c0e8a02d8e49676ba6111a33c4ae34f97bb65b08

SHA256
a3e83da551b9a333201d50e9755771689f20c1ca0e1772cc8c785c9c6e9f1e50

SHA512
269b08b9090d13dcd33b29301f76abc5cbd441e20102ebdeb342b45e22138638ea6f4ff4fb6c909503ca748efdffd9d20341c7866ba6367d53d0b7474c165491

Download Submit
\ProgramData\Remcos\remcos.exe

Filesize
482KB

MD5
e061f0c3a1fc124de1ff7e6dd44e6da7

SHA1
a17fa68fef483ae910661e06c0f83d298e70fe15

SHA256
86f196e6db84218ec0cb4ead59880352b3dfa01d74af93af60347883632f2bf3

SHA512
02ec6180f41701e27fb90f32a0294352f9739f186b7a16521d0599f90ae31e28fea82370d7dafd943f915035852a8018b8be88b95374ae607889a0b01333dab8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads