remcos | 402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361

General

Target

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Size

1.2MB
MD5

08b5fa6876e0dc8d5c226597d89e646b
SHA1

4b5f7b0dd2303c81427f9ab47ff9046c43718552
SHA256

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361
SHA512

4f20a03dbcb5e16c4e934e67455eb48bf7bd9681b5fdc731bf278409c78e698527ee125ac2ed0e3f09bc1551a2684e16ba3e34613da9a1eb32bca781b85ea48c
SSDEEP

24576:IPMpzxWvSQVw/BSCDyBSvbSFMySqL1fjv4G4uKZ0PU:JWvxiSCWBSzsVL1fktec

Score

10^/10

remcos remotehost discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

154.216.16.54:6092

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YJ70D0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
true
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2696 powershell.exe
3032 powershell.exe
Executes dropped EXE 6 IoCs

Processes:

remcos.exeremcos.exeremcos.exeremcos.exeremcos.exeremcos.exe

pid process

1324 remcos.exe
1508 remcos.exe
2080 remcos.exe
756 remcos.exe
2404 remcos.exe
2032 remcos.exe
Loads dropped DLL 1 IoCs

Processes:

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

pid process

580 402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

pid	process
2696	powershell.exe
3032	powershell.exe

pid	process
1324	remcos.exe
1508	remcos.exe
2080	remcos.exe
756	remcos.exe
2404	remcos.exe
2032	remcos.exe

pid	process
580	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

description	pid	process	target process
PID 2884 set thread context of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exeremcos.exepowershell.exe402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exepowershell.exeremcos.exepowershell.exe

pid	process
2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
2696	powershell.exe
1324	remcos.exe
1324	remcos.exe
1324	remcos.exe
1324	remcos.exe
1324	remcos.exe
1324	remcos.exe
1324	remcos.exe
1324	remcos.exe
1324	remcos.exe
1324	remcos.exe
3032	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exepowershell.exeremcos.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	1324	remcos.exe
Token: SeDebugPrivilege	3032	powershell.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exeremcos.exe

description	pid	process	target process
PID 2884 wrote to memory of 2696	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	powershell.exe
PID 2884 wrote to memory of 2696	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	powershell.exe
PID 2884 wrote to memory of 2696	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	powershell.exe
PID 2884 wrote to memory of 2696	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	powershell.exe
PID 2884 wrote to memory of 2788	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 2788	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 2788	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 2788	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 2884 wrote to memory of 580	2884	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 580 wrote to memory of 1324	580	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	remcos.exe
PID 580 wrote to memory of 1324	580	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	remcos.exe
PID 580 wrote to memory of 1324	580	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	remcos.exe
PID 580 wrote to memory of 1324	580	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	remcos.exe
PID 1324 wrote to memory of 3032	1324	remcos.exe	powershell.exe
PID 1324 wrote to memory of 3032	1324	remcos.exe	powershell.exe
PID 1324 wrote to memory of 3032	1324	remcos.exe	powershell.exe
PID 1324 wrote to memory of 3032	1324	remcos.exe	powershell.exe
PID 1324 wrote to memory of 1508	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 1508	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 1508	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 1508	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2080	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2080	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2080	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2080	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 756	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 756	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 756	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 756	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2404	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2404	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2404	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2404	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2032	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2032	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2032	1324	remcos.exe	remcos.exe
PID 1324 wrote to memory of 2032	1324	remcos.exe	remcos.exe

C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
"C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
  "C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe"
  2⤵
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
  "C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3032
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:1508
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:2080
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:756
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:2404
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
32ca5ba1c1d83ed34b0b61697a238b7d

SHA1
6fe21d21e2687686d87b5a7d3b4e11e25087a930

SHA256
05aff88bf97131ea13221ba83a64891e2c400d9f05afae909a1fd6cd03ba980c

SHA512
42f6df6cb782f7869f347e123ddc86a1cfe30261344b57b01c1f9b073348dacc6bee31ec2efd168da291dd2f49a691b477e5739eab00fc11530215ce9c5bff86

Download Submit
\ProgramData\Remcos\remcos.exe

Filesize
1.2MB

MD5
08b5fa6876e0dc8d5c226597d89e646b

SHA1
4b5f7b0dd2303c81427f9ab47ff9046c43718552

SHA256
402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361

SHA512
4f20a03dbcb5e16c4e934e67455eb48bf7bd9681b5fdc731bf278409c78e698527ee125ac2ed0e3f09bc1551a2684e16ba3e34613da9a1eb32bca781b85ea48c

Download Submit
memory/580-12-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-14-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-28-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-10-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-13-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-8-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-11-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-17-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-19-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-20-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/580-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1324-30-0x00000000003D0000-0x0000000000500000-memory.dmp

Filesize
1.2MB

Download
memory/1324-33-0x0000000005270000-0x0000000005334000-memory.dmp

Filesize
784KB

Download
memory/2884-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2884-6-0x0000000004A90000-0x0000000004B54000-memory.dmp

Filesize
784KB

Download
memory/2884-0-0x0000000073DCE000-0x0000000073DCF000-memory.dmp

Filesize
4KB

Download
memory/2884-5-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2884-23-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2884-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2884-4-0x0000000073DCE000-0x0000000073DCF000-memory.dmp

Filesize
4KB

Download
memory/2884-1-0x0000000001380000-0x00000000014B0000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads