remcos | 6ae4cd7a6499338fc9b4c156be801ca893c6f94a5212b5de0fcc9c5e8a8c251e

General

Target

FedEX Arrival - AWB# 102235506763.exe
Size

500KB
MD5

591e37c2118d8137bca5bc35a8c0a986
SHA1

dd752209e4f9a1a18a09dce2f90efc2a74b66ae0
SHA256

16e1fc1631183e97739837a4d7fb915d77eedec6784b66402ca3c20138080b78
SHA512

b0d29c79271dac601e4ecdd5613d3a8e263214ca5b4c77222482f39f45f5bf8ade0b6abb6f05076e5965d29df9446c0456265284122e887dbd2fa55f4bc6c727
SSDEEP

12288:iYLJjm5DBJMATlVjXqDMsArPAA0WvBQgamTvaygr+T:iYNjIEADeIssPAATdoyVT

Score

10^/10

remcos benchao discovery rat

Malware Config

Extracted

Family

remcos

Botnet

benchao

C2

tochisglobal.ddns.net:6426

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-9R4HLX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 7 IoCs

pid	Process
3200	FedEX Arrival - AWB# 102235506763.exe
3200	FedEX Arrival - AWB# 102235506763.exe
3200	FedEX Arrival - AWB# 102235506763.exe
3200	FedEX Arrival - AWB# 102235506763.exe
3200	FedEX Arrival - AWB# 102235506763.exe
3200	FedEX Arrival - AWB# 102235506763.exe
3200	FedEX Arrival - AWB# 102235506763.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5088	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3200	FedEX Arrival - AWB# 102235506763.exe
5088	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3200 set thread context of 5088	3200	FedEX Arrival - AWB# 102235506763.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FedEX Arrival - AWB# 102235506763.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3200	FedEX Arrival - AWB# 102235506763.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5088	wab.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 5088	3200	FedEX Arrival - AWB# 102235506763.exe	105
PID 3200 wrote to memory of 5088	3200	FedEX Arrival - AWB# 102235506763.exe	105
PID 3200 wrote to memory of 5088	3200	FedEX Arrival - AWB# 102235506763.exe	105
PID 3200 wrote to memory of 5088	3200	FedEX Arrival - AWB# 102235506763.exe	105
PID 3200 wrote to memory of 5088	3200	FedEX Arrival - AWB# 102235506763.exe	105

C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235506763.exe
"C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235506763.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\windows mail\wab.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235506763.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdE7E1.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdE7E1.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
memory/3200-28-0x0000000077C01000-0x0000000077D21000-memory.dmp

Filesize
1.1MB

Download
memory/3200-29-0x0000000074A65000-0x0000000074A66000-memory.dmp

Filesize
4KB

Download
memory/5088-30-0x0000000077C88000-0x0000000077C89000-memory.dmp

Filesize
4KB

Download
memory/5088-31-0x0000000077CA5000-0x0000000077CA6000-memory.dmp

Filesize
4KB

Download
memory/5088-32-0x0000000000B60000-0x0000000001DB4000-memory.dmp

Filesize
18.3MB

Download
memory/5088-37-0x0000000077C01000-0x0000000077D21000-memory.dmp

Filesize
1.1MB

Download
memory/5088-36-0x0000000000B60000-0x0000000001DB4000-memory.dmp

Filesize
18.3MB

Download
memory/5088-40-0x0000000000B60000-0x0000000001DB4000-memory.dmp

Filesize
18.3MB

Download
memory/5088-43-0x0000000000B60000-0x0000000001DB4000-memory.dmp

Filesize
18.3MB

Download

Analysis

Sharing