remcos | 0b606f6d0ce44922bf456bee5e6e8acf1b343521b2d5d4c5838926cc0484e052

General

Target

HSG-IVN-2093456FIN.exe
Size

894KB
MD5

53b79ccad8bee5f9027601500616a975
SHA1

0f52c391a610e1d79d148dd70a4cd90c952dddae
SHA256

0b606f6d0ce44922bf456bee5e6e8acf1b343521b2d5d4c5838926cc0484e052
SHA512

5422ef61678dd02424492e1c02ae96e063f8a43713043560db3e3c788e899cb11bc5b8de9c4318f51491deb5bc4bb9ddfb6fa85eabc3c2f3322d17e0c9cc481b
SSDEEP

12288:260nsDt02aQqTSpqdtQxIUPXnohqsMtc18p1THM4yHXxKoO3XdgO6wSmv:21naampqdGTocsEcn467O3Xdgrk

Score

10^/10

remcos czt discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

czt

C2

aadavidron.duckdns.org:53848

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Windeep.exe
copy_folder
AppDir
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FS2BKT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2552	powershell.exe
2556	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

HSG-IVN-2093456FIN.exe

description	pid	Process	procid_target
PID 2676 set thread context of 2908	2676	HSG-IVN-2093456FIN.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

HSG-IVN-2093456FIN.exepowershell.exepowershell.exeschtasks.exeHSG-IVN-2093456FIN.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HSG-IVN-2093456FIN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HSG-IVN-2093456FIN.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
2552	powershell.exe
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

HSG-IVN-2093456FIN.exe

pid	Process
2908	HSG-IVN-2093456FIN.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

HSG-IVN-2093456FIN.exe

description	pid	Process	procid_target
PID 2676 wrote to memory of 2552	2676	HSG-IVN-2093456FIN.exe	30
PID 2676 wrote to memory of 2552	2676	HSG-IVN-2093456FIN.exe	30
PID 2676 wrote to memory of 2552	2676	HSG-IVN-2093456FIN.exe	30
PID 2676 wrote to memory of 2552	2676	HSG-IVN-2093456FIN.exe	30
PID 2676 wrote to memory of 2556	2676	HSG-IVN-2093456FIN.exe	32
PID 2676 wrote to memory of 2556	2676	HSG-IVN-2093456FIN.exe	32
PID 2676 wrote to memory of 2556	2676	HSG-IVN-2093456FIN.exe	32
PID 2676 wrote to memory of 2556	2676	HSG-IVN-2093456FIN.exe	32
PID 2676 wrote to memory of 2684	2676	HSG-IVN-2093456FIN.exe	34
PID 2676 wrote to memory of 2684	2676	HSG-IVN-2093456FIN.exe	34
PID 2676 wrote to memory of 2684	2676	HSG-IVN-2093456FIN.exe	34
PID 2676 wrote to memory of 2684	2676	HSG-IVN-2093456FIN.exe	34
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37
PID 2676 wrote to memory of 2908	2676	HSG-IVN-2093456FIN.exe	37

C:\Users\Admin\AppData\Local\Temp\HSG-IVN-2093456FIN.exe
"C:\Users\Admin\AppData\Local\Temp\HSG-IVN-2093456FIN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HSG-IVN-2093456FIN.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VSNeHYIHmY.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VSNeHYIHmY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD1A1.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\HSG-IVN-2093456FIN.exe
  "C:\Users\Admin\AppData\Local\Temp\HSG-IVN-2093456FIN.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
84ee5fa2c4dde0cbb377f14ec93d081b

SHA1
328f26f649631348564e94aa2ca9caacd4f0d3a7

SHA256
73c0ab83090bc96444f2dd2c264c531e785e65dd0dc58642812da7e4f0defa9f

SHA512
1bf29a656dabefe31afb0075bf98be7a867e0d4e286101ab70717e4855cead35f911d7958593830af9ed4ff31f3e2ec4fe4a8331e341924a5acaeb2593847719

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD1A1.tmp

Filesize
1KB

MD5
b958a5c8db9e473d6aae01b47b3ff860

SHA1
6542234c33d76d4a87fc66f24c41b95a33f84083

SHA256
72352efd51b1a3e3d9d223bf829a4d87153f1e60806b63316c66976353715287

SHA512
0ffc2133b9dc2569727b7a323cf401c701bbeba75cc83624f10de02d6e1204970f6f50c0c8e7b2751672a34994a19a2027c3c6bb07cf1f0ddef216dccdc05c3b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
9a87f1db44545385d4bd55cc280481e3

SHA1
bd3963579a9ea8ce6d752d5d607891127a33a94c

SHA256
744e69be2853d41aa8f30ee26e81d603f53f386779d27b1b085335500763b615

SHA512
bb231cf634d1ff6905924bf9eed0eed60182fdd8e00771954650bef097a7648cce03b6745350b3cd136050e2118140001d1a66e385f980fe76b4a24675c367bd

Download Submit
memory/2676-38-0x0000000073DD0000-0x00000000744BE000-memory.dmp

Filesize
6.9MB

Download
memory/2676-3-0x0000000000320000-0x0000000000332000-memory.dmp

Filesize
72KB

Download
memory/2676-4-0x0000000073DDE000-0x0000000073DDF000-memory.dmp

Filesize
4KB

Download
memory/2676-5-0x0000000073DD0000-0x00000000744BE000-memory.dmp

Filesize
6.9MB

Download
memory/2676-6-0x0000000004F50000-0x0000000005014000-memory.dmp

Filesize
784KB

Download
memory/2676-1-0x0000000000E00000-0x0000000000EE6000-memory.dmp

Filesize
920KB

Download
memory/2676-0-0x0000000073DDE000-0x0000000073DDF000-memory.dmp

Filesize
4KB

Download
memory/2676-2-0x0000000073DD0000-0x00000000744BE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-44-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-33-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-32-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-73-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-27-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-19-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-23-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-21-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-34-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-39-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-37-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-45-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-25-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-50-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-51-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-57-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-60-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-66-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-29-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads