remcos | 5eba0fc4031786d1d2744beace12ab4116df7ce799c85a72087996d6013dc0a9

General

Target

pizoooooooooon.exe
Size

469KB
MD5

edbc5efff13abc4bbbe32422508f413c
SHA1

53aaa3aee4fca7bee5381040878fb752d606a9fd
SHA256

5eba0fc4031786d1d2744beace12ab4116df7ce799c85a72087996d6013dc0a9
SHA512

4eb254d3acf692ea8267db2db519beb3e7c052c70ffa3498fc4cedfed4e935bb6e61984b1638bfcc7e52876b9f981ec4a2831f1fcf53a7ce6898e71657d03af9
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSPn9:uiLJbpI7I2WhQqZ7P9

Score

10^/10

remcos remotehost discovery evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

items-jeffrey.gl.at.ply.gg:58427

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
system.exe
copy_folder
Remcos
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-B5GG3O
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

pizoooooooooon.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	pizoooooooooon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

220 WScript.exe
Executes dropped EXE 1 IoCs

Processes:

system.exe

pid process

2860 system.exe

pid	process
220	WScript.exe

pid	process
2860	system.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

pizoooooooooon.exesystem.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	pizoooooooooon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	pizoooooooooon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	system.exe

Drops file in System32 directory 3 IoCs

Processes:

pizoooooooooon.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Remcos\system.exe	pizoooooooooon.exe
File opened for modification	C:\Windows\SysWOW64\Remcos\system.exe	pizoooooooooon.exe
File opened for modification	C:\Windows\SysWOW64\Remcos	pizoooooooooon.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

system.exe

description pid process target process

PID 2860 set thread context of 1348 2860 system.exe iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2860 set thread context of 1348	2860	system.exe	iexplore.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exesystem.execmd.exereg.exepizoooooooooon.execmd.exereg.exeWScript.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pizoooooooooon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

Processes:

pizoooooooooon.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings pizoooooooooon.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

4952 reg.exe
3552 reg.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

system.exe

pid process

2860 system.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	pizoooooooooon.exe

pid	process
4952	reg.exe
3552	reg.exe

pid	process
2860	system.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

pizoooooooooon.execmd.exeWScript.execmd.exesystem.execmd.exe

description	pid	process	target process
PID 4980 wrote to memory of 964	4980	pizoooooooooon.exe	cmd.exe
PID 4980 wrote to memory of 964	4980	pizoooooooooon.exe	cmd.exe
PID 4980 wrote to memory of 964	4980	pizoooooooooon.exe	cmd.exe
PID 964 wrote to memory of 4952	964	cmd.exe	reg.exe
PID 964 wrote to memory of 4952	964	cmd.exe	reg.exe
PID 964 wrote to memory of 4952	964	cmd.exe	reg.exe
PID 4980 wrote to memory of 220	4980	pizoooooooooon.exe	WScript.exe
PID 4980 wrote to memory of 220	4980	pizoooooooooon.exe	WScript.exe
PID 4980 wrote to memory of 220	4980	pizoooooooooon.exe	WScript.exe
PID 220 wrote to memory of 5020	220	WScript.exe	cmd.exe
PID 220 wrote to memory of 5020	220	WScript.exe	cmd.exe
PID 220 wrote to memory of 5020	220	WScript.exe	cmd.exe
PID 5020 wrote to memory of 2860	5020	cmd.exe	system.exe
PID 5020 wrote to memory of 2860	5020	cmd.exe	system.exe
PID 5020 wrote to memory of 2860	5020	cmd.exe	system.exe
PID 2860 wrote to memory of 2996	2860	system.exe	cmd.exe
PID 2860 wrote to memory of 2996	2860	system.exe	cmd.exe
PID 2860 wrote to memory of 2996	2860	system.exe	cmd.exe
PID 2860 wrote to memory of 1348	2860	system.exe	iexplore.exe
PID 2860 wrote to memory of 1348	2860	system.exe	iexplore.exe
PID 2860 wrote to memory of 1348	2860	system.exe	iexplore.exe
PID 2860 wrote to memory of 1348	2860	system.exe	iexplore.exe
PID 2996 wrote to memory of 3552	2996	cmd.exe	reg.exe
PID 2996 wrote to memory of 3552	2996	cmd.exe	reg.exe
PID 2996 wrote to memory of 3552	2996	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\pizoooooooooon.exe
"C:\Users\Admin\AppData\Local\Temp\pizoooooooooon.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4952
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\Remcos\system.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SysWOW64\Remcos\system.exe
      C:\Windows\SysWOW64\Remcos\system.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2996
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3552
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        
        PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
536B

MD5
7b0c565618383b9ffeea6461bd3e8639

SHA1
02f543d75c0d89fec1d366a219369e3eb7efdc27

SHA256
f37608aab9baeae29764a508225a532df88565d605596553c70e1a29702fa2ba

SHA512
73a4e469b220afa5da5342d37c896964bd36c4be5f26e478ee18aedddd6e65a44e212dd10a0c579ae139591197b7c395b8edfdd50252eb71b86ad7b603eacd3f

Download Submit
C:\Windows\SysWOW64\Remcos\system.exe

Filesize
469KB

MD5
edbc5efff13abc4bbbe32422508f413c

SHA1
53aaa3aee4fca7bee5381040878fb752d606a9fd

SHA256
5eba0fc4031786d1d2744beace12ab4116df7ce799c85a72087996d6013dc0a9

SHA512
4eb254d3acf692ea8267db2db519beb3e7c052c70ffa3498fc4cedfed4e935bb6e61984b1638bfcc7e52876b9f981ec4a2831f1fcf53a7ce6898e71657d03af9

Download Submit
memory/1348-10-0x0000000000D00000-0x0000000000D7F000-memory.dmp

Filesize
508KB

Download
memory/1348-9-0x0000000000D00000-0x0000000000D7F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads