remcos | d30e71d321786a1cda09b0c75d408a8541b6167b6753de08f46504d90d2af129 | Triage

Sharing

General

Target

d30e71d321786a1cda09b0c75d408a8541b6167b6753de08f46504d90d2af129.msi
Size

4.0MB
Sample

240928-gd1pzasclg
MD5

bce2b57d15105b59a838eb1bd12aa7ee
SHA1

81d4e952363ec181cd06007fbbd5a8b83cce51cf
SHA256

d30e71d321786a1cda09b0c75d408a8541b6167b6753de08f46504d90d2af129
SHA512

4fd8dee6ca059a1174ceed13d86843c03150424ff06305e5d35fac0e3a66a28e477fe19a138c2526ad87ccadb9251d68ebbf6d024e053959dee698a8140b499a
SSDEEP

98304:xptfJOkKJqbdkE3GCIA/DCSlT/IZY//xEYQvjGkvUco5B1:151xkE3G8XIKB27dMco5

Score

10^/10

remcos backup_pip discovery persistence privilege_escalation rat

Malware Config

Extracted

Family

remcos

Botnet

BACKUP_PIP

C2

heavytank21gh.com:4422

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
info.dat
keylog_flag
false
keylog_folder
tmpdata
mouse_option
false
mutex
aujifbh8123-1M56R1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  d30e71d321786a1cda09b0c75d408a8541b6167b6753de08f46504d90d2af129.msi
- Size
  
  4.0MB
- MD5
  
  bce2b57d15105b59a838eb1bd12aa7ee
- SHA1
  
  81d4e952363ec181cd06007fbbd5a8b83cce51cf
- SHA256
  
  d30e71d321786a1cda09b0c75d408a8541b6167b6753de08f46504d90d2af129
- SHA512
  
  4fd8dee6ca059a1174ceed13d86843c03150424ff06305e5d35fac0e3a66a28e477fe19a138c2526ad87ccadb9251d68ebbf6d024e053959dee698a8140b499a
- SSDEEP
  
  98304:xptfJOkKJqbdkE3GCIA/DCSlT/IZY//xEYQvjGkvUco5B1:151xkE3G8XIKB27dMco5
Score

10^/10

remcos backup_pip discovery persistence privilege_escalation rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Installer Packages

Privilege Escalation

Event Triggered Execution

Installer Packages

Defense Evasion

File and Directory Permissions Modification

System Binary Proxy Execution

Msiexec

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

remcosbackup_pipdiscoverypersistenceprivilege_escalationrat

behavioral2

remcosbackup_pipdiscoverypersistenceprivilege_escalationrat