remcos | 8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38

General

Target

8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
Size

937KB
MD5

d153584c42340d402d6e44454c3ad5b2
SHA1

e14bfbe2f059a26e75755e29f032c5e0d3cf673c
SHA256

8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38
SHA512

599b52b887b1c71515ec37ac072b4201a5fa023445b88390a6af0d7e51c90b4d71e02e6c273982efd45f4f2c781fd1608eff5d916968d7c70b06be0b103b33f9
SSDEEP

24576:/iUmSB/o5d1ubcvq/q9JwVZeYc+V8leByGrKzp6B3IjM://mU/ohubcvq/2wVZee8leDrKzp638

Score

10^/10

remcos remotehost discovery evasion rat trojan upx

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

system6233.duckdns.org:3045

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HSZZPP
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1164-0-0x0000000000ED0000-0x00000000010D1000-memory.dmp	upx
behavioral2/memory/1164-14-0x0000000000ED0000-0x00000000010D1000-memory.dmp	upx
behavioral2/memory/624-31-0x0000000000ED0000-0x00000000010D1000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1164-14-0x0000000000ED0000-0x00000000010D1000-memory.dmp	autoit_exe
behavioral2/memory/624-31-0x0000000000ED0000-0x00000000010D1000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 624 set thread context of 1444	624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	95

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1960	reg.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1444	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 4444	1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	93
PID 1164 wrote to memory of 4444	1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	93
PID 1164 wrote to memory of 4444	1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	93
PID 1164 wrote to memory of 624	1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	94
PID 1164 wrote to memory of 624	1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	94
PID 1164 wrote to memory of 624	1164	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	94
PID 624 wrote to memory of 1444	624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	95
PID 624 wrote to memory of 1444	624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	95
PID 624 wrote to memory of 1444	624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	95
PID 624 wrote to memory of 1444	624	8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe	95
PID 1444 wrote to memory of 1020	1444	svchost.exe	96
PID 1444 wrote to memory of 1020	1444	svchost.exe	96
PID 1444 wrote to memory of 1020	1444	svchost.exe	96
PID 1020 wrote to memory of 1960	1020	cmd.exe	98
PID 1020 wrote to memory of 1960	1020	cmd.exe	98
PID 1020 wrote to memory of 1960	1020	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
"C:\Users\Admin\AppData\Local\Temp\8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe"
  2⤵
  PID:4444
- C:\Users\Admin\AppData\Local\Temp\8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe
  "C:\Users\Admin\AppData\Local\Temp\8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
aba283ee7515cdcc24da7438afe2eeb1

SHA1
77f976e9e8b3d17da527a64dde41e95ab2969036

SHA256
3021d39c08f444d9a3455d757941c85731a70de1a59a090710311edb72a2e488

SHA512
0a6598eabbfa43b5cdc9a0ab08eaf91e26a2dc0fe93041f91e5cb3dbfb32b16e1ac65d1150755ab7229e373be955c0c79b8a6faa47a5278c5644c46f4b5e4c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\porcelainize

Filesize
84KB

MD5
4181030c43ec488dfaa8c6b229aaa504

SHA1
54e3c166518aea622706c3de1c8a3fedfa0ef9fd

SHA256
ed49839ee3711a50aaaa32d033e8127f3f0670a5e661a5bb64233cee01e53d99

SHA512
0398cc9a78aa338f716090df7c673a8bc8574a2e3ef080083092ce5b6dd489ea17c4fa55178ac94dc77f9a7fb9dede5b9785cd98dc79eef847ae3e71879bdc80

Download Submit
memory/624-31-0x0000000000ED0000-0x00000000010D1000-memory.dmp

Filesize
2.0MB

Download
memory/1164-0-0x0000000000ED0000-0x00000000010D1000-memory.dmp

Filesize
2.0MB

Download
memory/1164-12-0x0000000000B80000-0x0000000000B84000-memory.dmp

Filesize
16KB

Download
memory/1164-14-0x0000000000ED0000-0x00000000010D1000-memory.dmp

Filesize
2.0MB

Download
memory/1444-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1444-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads