remcos | d357a2232ad73608f19ef5985d107513da9fc9de1d2e77f77ca259099742b913

General

Target

Jagtap Trading - order #JEW-39-16.02.2021.exe
Size

700KB
MD5

44f10846980aaad7a8c4984b214aa4b0
SHA1

77d87acb0ec259ea13dbe261fb51845618bad7b4
SHA256

753cc07b3d3e9d5cc44061f9f5b2933d2e1f7f18155f9c17346592e254eab0c2
SHA512

2af313958523ffb30473ba3111331a267dc05a1ac1680c3129cb88e143a14ea84a3a30536c98fe28b7841162dd750197f65ca0b161a6757f1d75735f4a4062cb
SSDEEP

12288:TBU93mpF4OWwA8rN91UCue1X2EN9+2ii+Tl:TGIWwAkN91Uk1GEFi

Score

10^/10

remcos host discovery rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

45.137.22.36:20201

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_mvishsbxyn
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Jagtap Trading - order #JEW-39-16.02.2021.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 448 set thread context of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jagtap Trading - order #JEW-39-16.02.2021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jagtap Trading - order #JEW-39-16.02.2021.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
448	Jagtap Trading - order #JEW-39-16.02.2021.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	Jagtap Trading - order #JEW-39-16.02.2021.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 4112	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	93
PID 448 wrote to memory of 4112	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	93
PID 448 wrote to memory of 4112	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	93
PID 448 wrote to memory of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95
PID 448 wrote to memory of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95
PID 448 wrote to memory of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95
PID 448 wrote to memory of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95
PID 448 wrote to memory of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95
PID 448 wrote to memory of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95
PID 448 wrote to memory of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95
PID 448 wrote to memory of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95
PID 448 wrote to memory of 3140	448	Jagtap Trading - order #JEW-39-16.02.2021.exe	95

C:\Users\Admin\AppData\Local\Temp\Jagtap Trading - order #JEW-39-16.02.2021.exe
"C:\Users\Admin\AppData\Local\Temp\Jagtap Trading - order #JEW-39-16.02.2021.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RpVVsgbdJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA0D.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4112
- C:\Users\Admin\AppData\Local\Temp\Jagtap Trading - order #JEW-39-16.02.2021.exe
  "C:\Users\Admin\AppData\Local\Temp\Jagtap Trading - order #JEW-39-16.02.2021.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEA0D.tmp

Filesize
1KB

MD5
4407afdfab2ddf9f7ecbc0f1d308f404

SHA1
886bcb64dc52427b96555f3f2cb799a2326c6c00

SHA256
afe7a36cd5b98003e43085876fd92c2160e93d153a366174fd69d0ba27c9287c

SHA512
31312e660644a73d508566b4fac7ac7d1206881494eef709c67f568e32a95b6168f7f32db16cc6074b90b77d1bd589c969185f2041c330dc1949c6e2e9322eae

Download Submit
memory/448-4-0x0000000004EB0000-0x0000000004F42000-memory.dmp

Filesize
584KB

Download
memory/448-5-0x0000000004E50000-0x0000000004E5A000-memory.dmp

Filesize
40KB

Download
memory/448-9-0x0000000074F7E000-0x0000000074F7F000-memory.dmp

Filesize
4KB

Download
memory/448-0-0x0000000074F7E000-0x0000000074F7F000-memory.dmp

Filesize
4KB

Download
memory/448-10-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/448-6-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/448-7-0x00000000050D0000-0x0000000005126000-memory.dmp

Filesize
344KB

Download
memory/448-11-0x0000000000DB0000-0x0000000000DFC000-memory.dmp

Filesize
304KB

Download
memory/448-3-0x00000000053C0000-0x0000000005964000-memory.dmp

Filesize
5.6MB

Download
memory/448-2-0x0000000004D40000-0x0000000004DDC000-memory.dmp

Filesize
624KB

Download
memory/448-8-0x00000000050B0000-0x00000000050BA000-memory.dmp

Filesize
40KB

Download
memory/448-1-0x0000000000340000-0x00000000003F6000-memory.dmp

Filesize
728KB

Download
memory/448-21-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/3140-17-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3140-20-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3140-22-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3140-23-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads