remcos | f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768

General

Target

f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
Size

511KB
MD5

77a1c8918ae7893671d3dfe3b410a107
SHA1

c863d6378582314b9898054031b0eb7019cff637
SHA256

f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768
SHA512

341f7d0749886c8b9efc4e3a2ec2f99bee712418a338a22261fd20d688ddc327cd80754ca36d5f640395cd87c58624b525b3341ac1beab445f45c6d57f1f27b3
SSDEEP

12288:QXbtieDFJ/9GGYLtORcN1zk2Mt4yGOup8WWfL8s:QXxpDFJ/99Y/WKVbs

Score

10^/10

remcos remotehost discovery rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

23.227.202.197:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QPTXAI
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 8 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2676-35-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/728-46-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/728-45-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3436-44-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/728-43-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2676-38-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3436-50-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3436-34-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2676-35-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/2676-38-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3436-44-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3436-50-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3436-34-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Loads dropped DLL 2 IoCs

pid	Process
2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 860	2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	94
PID 860 set thread context of 3436	860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 860	2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	94
PID 2788 wrote to memory of 860	2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	94
PID 2788 wrote to memory of 860	2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	94
PID 2788 wrote to memory of 860	2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	94
PID 2788 wrote to memory of 860	2788	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	94
PID 860 wrote to memory of 3436	860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	99
PID 860 wrote to memory of 3436	860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	99
PID 860 wrote to memory of 3436	860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	99
PID 860 wrote to memory of 2676	860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	100
PID 860 wrote to memory of 2676	860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	100
PID 860 wrote to memory of 2676	860	f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe	100

C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
"C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
  "C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
    C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe /stext "C:\Users\Admin\AppData\Local\Temp\ihmrxzeoqbcdsbmpem"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
    C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe /stext "C:\Users\Admin\AppData\Local\Temp\tjskyrpqejuiuiatvxrko"
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe
    C:\Users\Admin\AppData\Local\Temp\f091affa4bfe7b5d24c784295f49ce788032b3dd89b0160e95caca1d08f92768.exe /stext "C:\Users\Admin\AppData\Local\Temp\vdfczkzkarmvewwxeiemrqlm"
    3⤵
    PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
250c14f26af4b7f068106a10deb8fa44

SHA1
f13fc5a5e67d405946a2df45429fde244aa17ce5

SHA256
5acb37143f055994f2db33abb3abe0f56308fd180c3835356921ec3d5d1db00d

SHA512
73a4977a80dfa2aac313a0e41a0af5f8e83d5e882574203ae94a631efc22e93ec3166f85c859b54a03630b91330b1e23df5b394318482315474e8337e3e3b639

Download Submit
C:\Users\Admin\AppData\Local\Temp\ihmrxzeoqbcdsbmpem

Filesize
4KB

MD5
ac300aeaf27709e2067788fdd4624843

SHA1
e98edd4615d35de96e30f1a0e13c05b42ee7eb7b

SHA256
d2637d58bb120dc6fefe2f38d6e0d4b308006b8639106a7f9e915fa80b5cc9d9

SHA512
09c46e708f9d253dccd4d943639d9f8126f868ae3dcd951aad12222bb98b5d3814676f878c8391b9bdab5dedcf5b9e9eaeb2ad3ffec57bda875198735586d4df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB42E.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
memory/728-37-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/728-39-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/728-43-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/728-45-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/728-46-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/860-29-0x0000000077741000-0x0000000077861000-memory.dmp

Filesize
1.1MB

Download
memory/860-78-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-25-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-23-0x0000000077741000-0x0000000077861000-memory.dmp

Filesize
1.1MB

Download
memory/860-19-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-84-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-18-0x00000000777E5000-0x00000000777E6000-memory.dmp

Filesize
4KB

Download
memory/860-17-0x00000000777C8000-0x00000000777C9000-memory.dmp

Filesize
4KB

Download
memory/860-63-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-16-0x0000000077741000-0x0000000077861000-memory.dmp

Filesize
1.1MB

Download
memory/860-81-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-66-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-60-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-75-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-69-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-72-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/860-57-0x0000000037410000-0x0000000037429000-memory.dmp

Filesize
100KB

Download
memory/860-56-0x0000000037410000-0x0000000037429000-memory.dmp

Filesize
100KB

Download
memory/860-53-0x0000000037410000-0x0000000037429000-memory.dmp

Filesize
100KB

Download
memory/2676-33-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2676-31-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2676-38-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2676-35-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2788-14-0x0000000077741000-0x0000000077861000-memory.dmp

Filesize
1.1MB

Download
memory/2788-15-0x00000000745A5000-0x00000000745A6000-memory.dmp

Filesize
4KB

Download
memory/3436-26-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3436-30-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3436-34-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3436-50-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3436-44-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing