remcos | 81cd20986cf64db5433eff8750449e847c7d327a8493b4dee1af9cb51b21d3e8

General

Target

PORTAFOLIO PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT/DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe
Size

4.0MB
MD5

6358b60b9e07fb80b705ec024e5e3fe9
SHA1

0af3b32f03055623e89036885952a398dd897252
SHA256

6272c72c830630f76aac92c2ad13e3f601aa7752e13d8713e150511754097eaa
SHA512

65fe12720f0dc375925a077dc7a7bacf2297ac7c957cbec9788f5c5b411f92529ba96b725d1214ac321e4ef326f4f9f9140bb497255498c03626df548a025915
SSDEEP

49152:HWGtLBcXq5IR6SVb8kq4pgquLMMji4NYxtJpkxhGjIKTbZB333zvm6t7holsw7W:ptLuYqgwh4NYxtJpkxhGxB333roJW

Score

10^/10

remcos raton discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RATON

C2

newtestdn.dns.army:1700

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
registros.dat
keylog_flag
false
keylog_folder
datos
mouse_option
false
mutex
hbdggdmmmskbsciihcjh-VVGXL8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Capturas de pantalla
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe

Deletes itself 1 IoCs

pid	Process
4348	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UniDesignerEditor = "C:\\Users\\Admin\\Music\\UniDesignerUpdater\\UniConvertVideo.exe"	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1932	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1932	3316	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe	95
PID 3316 wrote to memory of 1932	3316	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe	95
PID 3316 wrote to memory of 1932	3316	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe	95
PID 3316 wrote to memory of 1932	3316	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe	95
PID 3316 wrote to memory of 1932	3316	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe	95
PID 1932 wrote to memory of 4348	1932	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe	102
PID 1932 wrote to memory of 4348	1932	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe	102
PID 1932 wrote to memory of 4348	1932	DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe	102

C:\Users\Admin\AppData\Local\Temp\PORTAFOLIO PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT\DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe
"C:\Users\Admin\AppData\Local\Temp\PORTAFOLIO PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT\DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\PORTAFOLIO PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT\DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe
  "C:\Users\Admin\AppData\Local\Temp\PORTAFOLIO PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT\DOC PRIORITARIO CANCELACIÓN DE CONTRATO 18 DE OCT.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\igvbumkqwkkrwvqfel.vbs"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\datos\registros.dat

Filesize
184B

MD5
04bac2ee50594f26b151fd0c4236c4a4

SHA1
fb5478a299a6eeb73c21fb8babc1b7aba72c44b8

SHA256
b7aa20bbad090376545cb3df6683bbfb295a79652c437ebc6921a5044c2b21a5

SHA512
b722a90ba903d67d451569cc3fb2115d4a009f4ed2c7ebfa999c7e7115cb4e81e929d9c62cbb56607fc3ad6a8fd4c7c87677b319bfbe698ae96f8b1a27f84724

Download Submit
C:\Users\Admin\AppData\Local\Temp\igvbumkqwkkrwvqfel.vbs

Filesize
900B

MD5
27c83ccbc9047bdb755f1a68a8ef7bd2

SHA1
dda8674c2c7ff5bc3c57198faf16a0d9b1b75df2

SHA256
8fa869c93120a4e4299a658d5e5098495760be55a28f7fd2a5e191a47dd5a30b

SHA512
bd6855a7ccc3b2cdd1b7cad1b799048ecfda8754c9c50c5c9a36ed6b423966d39f94dbdd0b5840f0425222889df0cda60e01b2704fa06fbddf655ecb66d55094

Download Submit
memory/1932-20-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-23-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-49-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-47-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-12-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-11-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-8-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-42-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-21-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-40-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-16-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-13-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-18-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-17-0x0000000000400000-0x0000000000818000-memory.dmp

Filesize
4.1MB

Download
memory/1932-39-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-38-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-36-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-19-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-35-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-26-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-27-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/1932-34-0x0000000000820000-0x00000000008A2000-memory.dmp

Filesize
520KB

Download
memory/3316-1-0x0000000000400000-0x0000000000818000-memory.dmp

Filesize
4.1MB

Download
memory/3316-25-0x0000000000517000-0x000000000052F000-memory.dmp

Filesize
96KB

Download
memory/3316-6-0x0000000000400000-0x0000000000818000-memory.dmp

Filesize
4.1MB

Download
memory/3316-0-0x0000000000400000-0x0000000000818000-memory.dmp

Filesize
4.1MB

Download
memory/3316-5-0x0000000000400000-0x0000000000818000-memory.dmp

Filesize
4.1MB

Download
memory/3316-3-0x0000000000400000-0x0000000000818000-memory.dmp

Filesize
4.1MB

Download
memory/3316-7-0x0000000000400000-0x0000000000818000-memory.dmp

Filesize
4.1MB

Download
memory/3316-10-0x0000000000400000-0x0000000000818000-memory.dmp

Filesize
4.1MB

Download
memory/3316-9-0x0000000000400000-0x0000000000818000-memory.dmp

Filesize
4.1MB

Download
memory/3316-2-0x0000000000517000-0x000000000052F000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads