remcos | c7f550c5813c050c7c815b7cc7be6f777264e439af4d3f109f82ea99b57f0e50

General

Target

HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
Size

396KB
MD5

a955ac034ab71cc35107fd81d4d0904a
SHA1

7e00fa5b9e8718d6ae19856ecc1be4cbf487a164
SHA256

ba52101e664d1ab4110977264bb16ff13c5bf4bdb004ddcacba915006d275b81
SHA512

48804a5469f810aa8f936e5ee5e466263a8da35d42c058fb7a77928b22135ea2e3b3bf41ad075a8449d3c13c4dcaa84aa6ce5e463c33ccc40e40c21cd90e847d
SSDEEP

12288:F3P+z2F99SVFC6UJiMCXxdS3uh57eNgZP:F342FUVMCXjlhVeNg5

Score

10^/10

remcos remotehost discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

3.0.1 Pro

Botnet

RemoteHost

C2

capriteam.ddns.net:1010

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-VHHYND
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 IoCs

pid	Process
2004	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2008	remcos.exe
5028	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 2396	3312	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	86
PID 2008 set thread context of 5028	2008	remcos.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3312	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
2008	remcos.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3312	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
2008	remcos.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2396	3312	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	86
PID 3312 wrote to memory of 2396	3312	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	86
PID 3312 wrote to memory of 2396	3312	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	86
PID 3312 wrote to memory of 2396	3312	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	86
PID 2396 wrote to memory of 2004	2396	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	87
PID 2396 wrote to memory of 2004	2396	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	87
PID 2396 wrote to memory of 2004	2396	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	87
PID 2004 wrote to memory of 3032	2004	WScript.exe	88
PID 2004 wrote to memory of 3032	2004	WScript.exe	88
PID 2004 wrote to memory of 3032	2004	WScript.exe	88
PID 3032 wrote to memory of 2008	3032	cmd.exe	90
PID 3032 wrote to memory of 2008	3032	cmd.exe	90
PID 3032 wrote to memory of 2008	3032	cmd.exe	90
PID 2008 wrote to memory of 5028	2008	remcos.exe	91
PID 2008 wrote to memory of 5028	2008	remcos.exe	91
PID 2008 wrote to memory of 5028	2008	remcos.exe	91
PID 2008 wrote to memory of 5028	2008	remcos.exe	91

C:\Users\Admin\AppData\Local\Temp\HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
"C:\Users\Admin\AppData\Local\Temp\HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Users\Admin\AppData\Local\Temp\HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe
  "C:\Users\Admin\AppData\Local\Temp\HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2008
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
644B

MD5
f0d01340e5c004f05ecd705538a911a6

SHA1
0f06aa4c4ac3c72fb8572f61a6dfeef86cb4a483

SHA256
0a71a6582d07e6832f82d6b4b3f4e4307bceebd5d82cee232570bee0c04c8a32

SHA512
a22f49628786978e3b1a6ac94cb87303c110669544c34ebb9521e8611cb98989a3949b2c892a25707c7471f7c9843bb06f850c404a429886723f6d05ab0c2862

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe

Filesize
396KB

MD5
a955ac034ab71cc35107fd81d4d0904a

SHA1
7e00fa5b9e8718d6ae19856ecc1be4cbf487a164

SHA256
ba52101e664d1ab4110977264bb16ff13c5bf4bdb004ddcacba915006d275b81

SHA512
48804a5469f810aa8f936e5ee5e466263a8da35d42c058fb7a77928b22135ea2e3b3bf41ad075a8449d3c13c4dcaa84aa6ce5e463c33ccc40e40c21cd90e847d

Download Submit
memory/2396-5-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2396-6-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2396-7-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2396-12-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2396-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2396-16-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2396-19-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3312-2-0x0000000077382000-0x0000000077383000-memory.dmp

Filesize
4KB

Download
memory/3312-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/3312-4-0x0000000002230000-0x0000000002233000-memory.dmp

Filesize
12KB

Download
memory/5028-28-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5028-30-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5028-31-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5028-32-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5028-37-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5028-38-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5028-39-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5028-40-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5028-41-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5028-42-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5028-43-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/5028-44-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads