remcos | c7f550c5813c050c7c815b7cc7be6f777264e439af4d3f109f82ea99b57f0e50

General

Target

HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
Size

396KB
MD5

a955ac034ab71cc35107fd81d4d0904a
SHA1

7e00fa5b9e8718d6ae19856ecc1be4cbf487a164
SHA256

ba52101e664d1ab4110977264bb16ff13c5bf4bdb004ddcacba915006d275b81
SHA512

48804a5469f810aa8f936e5ee5e466263a8da35d42c058fb7a77928b22135ea2e3b3bf41ad075a8449d3c13c4dcaa84aa6ce5e463c33ccc40e40c21cd90e847d
SSDEEP

12288:F3P+z2F99SVFC6UJiMCXxdS3uh57eNgZP:F342FUVMCXjlhVeNg5

Score

10^/10

remcos remotehost discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

3.0.1 Pro

Botnet

RemoteHost

C2

capriteam.ddns.net:1010

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-VHHYND
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Deletes itself 1 IoCs

pid	Process
1940	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2844	remcos.exe
2216	remcos.exe

Loads dropped DLL 2 IoCs

pid	Process
2812	cmd.exe
2812	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 1816	2416	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	30
PID 2844 set thread context of 2216	2844	remcos.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2416	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
2844	remcos.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2416	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
2844	remcos.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1816	2416	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	30
PID 2416 wrote to memory of 1816	2416	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	30
PID 2416 wrote to memory of 1816	2416	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	30
PID 2416 wrote to memory of 1816	2416	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	30
PID 2416 wrote to memory of 1816	2416	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	30
PID 1816 wrote to memory of 1940	1816	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	31
PID 1816 wrote to memory of 1940	1816	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	31
PID 1816 wrote to memory of 1940	1816	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	31
PID 1816 wrote to memory of 1940	1816	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	31
PID 1940 wrote to memory of 2812	1940	WScript.exe	32
PID 1940 wrote to memory of 2812	1940	WScript.exe	32
PID 1940 wrote to memory of 2812	1940	WScript.exe	32
PID 1940 wrote to memory of 2812	1940	WScript.exe	32
PID 2812 wrote to memory of 2844	2812	cmd.exe	34
PID 2812 wrote to memory of 2844	2812	cmd.exe	34
PID 2812 wrote to memory of 2844	2812	cmd.exe	34
PID 2812 wrote to memory of 2844	2812	cmd.exe	34
PID 2844 wrote to memory of 2216	2844	remcos.exe	35
PID 2844 wrote to memory of 2216	2844	remcos.exe	35
PID 2844 wrote to memory of 2216	2844	remcos.exe	35
PID 2844 wrote to memory of 2216	2844	remcos.exe	35
PID 2844 wrote to memory of 2216	2844	remcos.exe	35

C:\Users\Admin\AppData\Local\Temp\HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
"C:\Users\Admin\AppData\Local\Temp\HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
  "C:\Users\Admin\AppData\Local\Temp\HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2844
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
644B

MD5
f0d01340e5c004f05ecd705538a911a6

SHA1
0f06aa4c4ac3c72fb8572f61a6dfeef86cb4a483

SHA256
0a71a6582d07e6832f82d6b4b3f4e4307bceebd5d82cee232570bee0c04c8a32

SHA512
a22f49628786978e3b1a6ac94cb87303c110669544c34ebb9521e8611cb98989a3949b2c892a25707c7471f7c9843bb06f850c404a429886723f6d05ab0c2862

Download Submit
\Users\Admin\AppData\Roaming\Remcos\remcos.exe

Filesize
396KB

MD5
a955ac034ab71cc35107fd81d4d0904a

SHA1
7e00fa5b9e8718d6ae19856ecc1be4cbf487a164

SHA256
ba52101e664d1ab4110977264bb16ff13c5bf4bdb004ddcacba915006d275b81

SHA512
48804a5469f810aa8f936e5ee5e466263a8da35d42c058fb7a77928b22135ea2e3b3bf41ad075a8449d3c13c4dcaa84aa6ce5e463c33ccc40e40c21cd90e847d

Download Submit
memory/1816-4-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1816-6-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1816-8-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1816-12-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1816-15-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1816-18-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2216-28-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2216-30-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2216-31-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2216-32-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2216-33-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2216-38-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2216-39-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2216-41-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2216-42-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2216-43-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2216-44-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2416-3-0x0000000000330000-0x0000000000333000-memory.dmp

Filesize
12KB

Download
memory/2416-2-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads