remcos | 635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5

General

Target
635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe
Size 672KB
Sample240610-sdmznazgla
SHA256 635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5
MD5 fcd2251a8050b590a00cfe90dde9bd4c
SHA1 5b05d0854a21630e891590d85c94fa9fbbb6a8c7
SHA512 eb4acb519c71325a4cfd2dab660a8c85605600f2a1fba8c5b8a03a84e814e1feb05e40399ea9615816a5f048cecb00f536b26eff2a99c0fa693cefc27772822e
SSDEEP 12288:NPzeh+nPLUUv4hVpyWSdPiwjllCr7up5dfLA:xSVpyWSdP9jlIKfk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

RemoteHost

C2

185.140.53.144:8691

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
dancas
keylog_path
%AppData%
mouse_option
false
mutex
Amdosc-JSJ6ES
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Warcha.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Paranada\\Girana.exe"	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2820 set thread context of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe
4752	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88
PID 2820 wrote to memory of 4752	2820	635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe	88

C:\Users\Admin\AppData\Local\Temp\635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe
"C:\Users\Admin\AppData\Local\Temp\635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.EXE
  "C:\Users\Admin\AppData\Local\Temp\635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5.EXE"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\Users\Admin\AppData\Roaming\dancas\logs.dat
Size 74B
SHA256 c10ae58c181985cc5411b37d92c38e9b6239fcdffcc5ca2be17a6192a067af1a
MD5 c89b34cae79a0aa7e902ff4d964089c6
SHA1 befcd55c2a7fbe34b2c334b00ba429b42b3744a3
SHA512 eb9bfa07425d682912bdff5c09aba1bce9d3e7e33e4dc3308f7ffee9dd46e979f16075fb74267d8dc25b6b5028f03bbc8e716f0e73133642cde24e380111a36c
MD5 SHA1 SHA512

Submit Download

memory/4752-4-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-13-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-21-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-25-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4752-29-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads