remcos | e6817cfed2b621a7695adafa26c08460f4ac38a0f2a8c5cdc5906d69672d3ffa

General

Target
Backdoor.exe
Size 92KB
Sample240706-25mbwaydpd
SHA256 e6817cfed2b621a7695adafa26c08460f4ac38a0f2a8c5cdc5906d69672d3ffa
MD5 62e0d4fab051f1d20d9ccc740f29a892
SHA1 94f377ee56dcff9ffb9b08cac9eef023d9de53db
SHA512 b0606aa90dfdae577cb8522e6f2d4992a325b2419b9f88a016353ed8bfce8cb2d85ed28e46353a1cf602389bf6d49e79ac4cd83f74685d271208d7bd381e5b92
SSDEEP 1536:4hhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6vrK:ehzYTGWVvJ8f2v1TbPzuMsIFSHNThy+Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos host evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

anyone-blogging.gl.at.ply.gg:22284

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
PowerShell.exe
copy_folder
Windows
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_xuvodfwuhh
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
10
startup_value
WinShell
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
password

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	Backdoor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	Backdoor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	PowerShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	PowerShell.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Backdoor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	Backdoor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	PowerShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	PowerShell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Control Panel\International\Geo\Nation	Backdoor.exe

Executes dropped EXE 1 IoCs

pid	Process
1220	PowerShell.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	PowerShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	Backdoor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	Backdoor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\PowerShell.exe\""	PowerShell.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	Backdoor.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1592	reg.exe
1116	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
940	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1220	PowerShell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1220	PowerShell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2512	1228	Backdoor.exe	84
PID 1228 wrote to memory of 2512	1228	Backdoor.exe	84
PID 1228 wrote to memory of 2512	1228	Backdoor.exe	84
PID 2512 wrote to memory of 1592	2512	cmd.exe	86
PID 2512 wrote to memory of 1592	2512	cmd.exe	86
PID 2512 wrote to memory of 1592	2512	cmd.exe	86
PID 1228 wrote to memory of 3280	1228	Backdoor.exe	87
PID 1228 wrote to memory of 3280	1228	Backdoor.exe	87
PID 1228 wrote to memory of 3280	1228	Backdoor.exe	87
PID 3280 wrote to memory of 940	3280	cmd.exe	89
PID 3280 wrote to memory of 940	3280	cmd.exe	89
PID 3280 wrote to memory of 940	3280	cmd.exe	89
PID 3280 wrote to memory of 1220	3280	cmd.exe	90
PID 3280 wrote to memory of 1220	3280	cmd.exe	90
PID 3280 wrote to memory of 1220	3280	cmd.exe	90
PID 1220 wrote to memory of 4944	1220	PowerShell.exe	91
PID 1220 wrote to memory of 4944	1220	PowerShell.exe	91
PID 1220 wrote to memory of 4944	1220	PowerShell.exe	91
PID 4944 wrote to memory of 1116	4944	cmd.exe	93
PID 4944 wrote to memory of 1116	4944	cmd.exe	93
PID 4944 wrote to memory of 1116	4944	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\Backdoor.exe
"C:\Users\Admin\AppData\Local\Temp\Backdoor.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:1592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:940
- - C:\Users\Admin\AppData\Roaming\Windows\PowerShell.exe
    "C:\Users\Admin\AppData\Roaming\Windows\PowerShell.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        Modifies registry key
        
        PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 104B
SHA256 3a487ebe6f5dd751c74e7b0298d05d1fd62d1adb3e491c696737957020385bc4
MD5 b0588b01f5a6aad1acac222f4d032fc0
SHA1 4f722bbb34e2e1851a85b761beb998e962fe657a
SHA512 50d7b61a470007208c61f85ff1b075836ebf0e7e5694ad93b51de5b85a864a7486a062c69e725170929b35d3035b1a11f8467956bd330fe380fb47b2e56fe8cc
MD5 SHA1 SHA512

Submit Download

PowerShell.exe

Path C:\Users\Admin\AppData\Roaming\Windows\PowerShell.exe
Size 92KB
SHA256 e6817cfed2b621a7695adafa26c08460f4ac38a0f2a8c5cdc5906d69672d3ffa
MD5 62e0d4fab051f1d20d9ccc740f29a892
SHA1 94f377ee56dcff9ffb9b08cac9eef023d9de53db
SHA512 b0606aa90dfdae577cb8522e6f2d4992a325b2419b9f88a016353ed8bfce8cb2d85ed28e46353a1cf602389bf6d49e79ac4cd83f74685d271208d7bd381e5b92
SSDEEP 1536:4hhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6vrK:ehzYTGWVvJ8f2v1TbPzuMsIFSHNThy+Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads