remcos | d5196c1a436f7b9760e64ad048f5ddf4cb65fdab69f0b8759ca9a4f30bbcf960

General

Target

INFORME TRANSACCIONAL - actividad interbancaria.exe
Size

2.6MB
MD5

b9f47ccb5b0431f0f7effa6b64160abf
SHA1

6ca8afdc1690d8454adeb9bc34112376b3ca8d50
SHA256

ed5e523acba44de27161183c6d947d65f73a11fabf39524a9b23b25fef951cfe
SHA512

d1ba1d6113babfd431577c2598173fdbc90253b463a27add0a7cd6ea9ed0a66737f70b07833b95771d2f3dff0195b2f7c6c8cc41bc110e288b6f385b5d85d15a
SSDEEP

49152:0KQAXCPpOSGoA2W5lu7hPMzLNLPzrg7gXqp2/o42kJdMAqcVGvXyG5n3l/901cfT:LwA2zKzLNLbrC5

Score

10^/10

remcos voltarger discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Voltarger

C2

assaasjdnsubdcdy.con-ip.com:1667

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6611TX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\MServerDesignerEditor = "C:\\Users\\Admin\\Music\\MServerDesignerUpdater\\MServerConvertVideo.exe"	INFORME TRANSACCIONAL - actividad interbancaria.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INFORME TRANSACCIONAL - actividad interbancaria.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INFORME TRANSACCIONAL - actividad interbancaria.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2268	INFORME TRANSACCIONAL - actividad interbancaria.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2268	2200	INFORME TRANSACCIONAL - actividad interbancaria.exe	29
PID 2200 wrote to memory of 2268	2200	INFORME TRANSACCIONAL - actividad interbancaria.exe	29
PID 2200 wrote to memory of 2268	2200	INFORME TRANSACCIONAL - actividad interbancaria.exe	29
PID 2200 wrote to memory of 2268	2200	INFORME TRANSACCIONAL - actividad interbancaria.exe	29
PID 2200 wrote to memory of 2268	2200	INFORME TRANSACCIONAL - actividad interbancaria.exe	29
PID 2200 wrote to memory of 2268	2200	INFORME TRANSACCIONAL - actividad interbancaria.exe	29

C:\Users\Admin\AppData\Local\Temp\INFORME TRANSACCIONAL - actividad interbancaria.exe
"C:\Users\Admin\AppData\Local\Temp\INFORME TRANSACCIONAL - actividad interbancaria.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\INFORME TRANSACCIONAL - actividad interbancaria.exe
  "C:\Users\Admin\AppData\Local\Temp\INFORME TRANSACCIONAL - actividad interbancaria.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
ae04b49742293be081812ffe22c7cc47

SHA1
1fb3c255a8e196b8185425c8df324e7c243a8012

SHA256
e9806b91d38fe20af12fd05b5445f0e9adafb70fb11b86a4e884f09d889f8c09

SHA512
4a165e0b1b9135d1fefb965b0d7803d53ccb077fb8b26df0cbaf34b82381ef497c03afc7abe7864525181d8d26d55f39e5434e6e776b0f10ac0080265c060020

Download Submit
memory/2200-16-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/2200-3-0x0000000000461000-0x0000000000479000-memory.dmp

Filesize
96KB

Download
memory/2200-4-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/2200-2-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/2200-7-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/2200-6-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/2200-14-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/2200-8-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/2200-0-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/2200-26-0x0000000000461000-0x0000000000479000-memory.dmp

Filesize
96KB

Download
memory/2268-13-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download
memory/2268-19-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download
memory/2268-22-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download
memory/2268-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2268-9-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download
memory/2268-23-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/2268-18-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads