remcos | 34102f0b2b79b27b821c7d06a88843fd0faf3fb39191bb685015d1ab909f1d4b

General

Target

b5e515f8a8f3839d70776c90f398c490N.exe
Size

139KB
MD5

b5e515f8a8f3839d70776c90f398c490
SHA1

21a6d57c7b72e5c1a60e368dd4a723db65c12e07
SHA256

34102f0b2b79b27b821c7d06a88843fd0faf3fb39191bb685015d1ab909f1d4b
SHA512

6776a38a1fb19a3351e1a50f7efbfa0f1f7bd84ada9e93febaef5a03c41bce94bb4801cb720d4a1d5b4f821f2f2f17c133a9c24c0aaf6ff522460ed03890c81b
SSDEEP

3072:xPd4n/M+WLcilrpgGH/GwY87mVmIXhIH4:xP6/M+WLckOBhVmIZ

Score

10^/10

remcos host discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

systemcontrol.ddns.net:45000

systemcontrol2.ddns.net:45000

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
OfficeUpgrade.exe
copy_folder
OfficeUpgrade
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
Upgrader.dat
keylog_flag
false
keylog_folder
Upgrader
keylog_path
%AppData%
mouse_option
false
mutex
req_khauflaoyr
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
OfficeUpgrade
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2176	wn2ra4ohzdr.exe
2780	wn2ra4ohzdr.exe

Loads dropped DLL 1 IoCs

pid	Process
2544	b5e515f8a8f3839d70776c90f398c490N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe"	b5e515f8a8f3839d70776c90f398c490N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 2780	2176	wn2ra4ohzdr.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wn2ra4ohzdr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wn2ra4ohzdr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5e515f8a8f3839d70776c90f398c490N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2780	wn2ra4ohzdr.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2176	2544	b5e515f8a8f3839d70776c90f398c490N.exe	30
PID 2544 wrote to memory of 2176	2544	b5e515f8a8f3839d70776c90f398c490N.exe	30
PID 2544 wrote to memory of 2176	2544	b5e515f8a8f3839d70776c90f398c490N.exe	30
PID 2544 wrote to memory of 2176	2544	b5e515f8a8f3839d70776c90f398c490N.exe	30
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32
PID 2176 wrote to memory of 2780	2176	wn2ra4ohzdr.exe	32

C:\Users\Admin\AppData\Local\Temp\b5e515f8a8f3839d70776c90f398c490N.exe
"C:\Users\Admin\AppData\Local\Temp\b5e515f8a8f3839d70776c90f398c490N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
  "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
    "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe

Filesize
139KB

MD5
b6bf01445ce93cea1c8a77394148e0a1

SHA1
1e05a3bb3e6468b66d02545157d6679d1314226d

SHA256
7401e8cbcf85e8bcff12558e6cbb92be0ab737fcf3556d567bcc934812f75d1b

SHA512
8b5bcaf3cd44c339b38ee5d647c54304beee3efd8a760a872263ff70ce9655940b3a893a2f044690e91d4a096ac2b206dd134378d8dce094fc8f50334b71df09

Download Submit
memory/2176-35-0x0000000074E30000-0x000000007551E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-14-0x0000000074E30000-0x000000007551E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-13-0x00000000002F0000-0x0000000000318000-memory.dmp

Filesize
160KB

Download
memory/2176-15-0x0000000074E30000-0x000000007551E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-36-0x0000000074E30000-0x000000007551E000-memory.dmp

Filesize
6.9MB

Download
memory/2544-1-0x0000000001370000-0x0000000001398000-memory.dmp

Filesize
160KB

Download
memory/2544-2-0x0000000074E30000-0x000000007551E000-memory.dmp

Filesize
6.9MB

Download
memory/2544-3-0x00000000009A0000-0x00000000009C0000-memory.dmp

Filesize
128KB

Download
memory/2544-12-0x0000000074E30000-0x000000007551E000-memory.dmp

Filesize
6.9MB

Download
memory/2544-0-0x0000000074E3E000-0x0000000074E3F000-memory.dmp

Filesize
4KB

Download
memory/2780-18-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2780-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2780-23-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2780-21-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2780-17-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2780-31-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2780-32-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2780-28-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2780-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads