remcos | 55f131be9f75250cc1291aafe4bc1593d460bcc71c62da5437aa14c894cf22f3

General

Target

2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe
Size

199KB
MD5

9915622262b1663ae9f851f664854000
SHA1

da9ae0706648eb10e1f5fbec1060f3eea8588ec6
SHA256

2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281
SHA512

d4a5583f1a531a292aece6f27f41b1abd37a31500f5def1459b5e801816bfddd1b1e6aea38f4682dd21a0e5e2ab17149d15b07242bd65fb8a6147e5247e5e61d
SSDEEP

3072:5NRCywDw1DiJkuQbojv4YQ/6Jfd9cV44zo7dkH6ChVLOWV49p6vfE2JvAEVXUOQn:5T4Dt+AxQnpe6HrLObovfTNAE2Ar+e2

Score

10^/10

remcos grace _ marcy discovery rat

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

GRACE _ MARCY

C2

103.153.77.83:4348

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
mozila.exe
copy_folder
mozila
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
mozila
keylog_path
%AppData%
mouse_option
false
mutex
mozila-VR8Q9A
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
mozila
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Loads dropped DLL 1 IoCs

pid	Process
2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 2544	2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe
2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe
2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe
2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2544	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2544	2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe	30
PID 2568 wrote to memory of 2544	2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe	30
PID 2568 wrote to memory of 2544	2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe	30
PID 2568 wrote to memory of 2544	2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe	30
PID 2568 wrote to memory of 2544	2568	2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe	30

C:\Users\Admin\AppData\Local\Temp\2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe
"C:\Users\Admin\AppData\Local\Temp\2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe
  "C:\Users\Admin\AppData\Local\Temp\2f14fefdd76197ec0b0eed44f534230e1e2b39d655edf87dd8571ceb966bb281.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mozila\logs.dat

Filesize
74B

MD5
aee908793c1598c506a8d8ecc0ee4559

SHA1
fab63884554b0b71e65e743b7a6e85b4ac147eea

SHA256
3c0f5348f037a2eec849de21638a252ef7e8b8db8727e73388599541712832dd

SHA512
8bbf2a981589d95095a0be5650009af1cfa281e3b088f67545a78ce98f2701664ec6519e6e00a2a7d6cd8465cc78ebca97ec0b33f5260ab4b652b77451734d74

Download Submit
\Users\Admin\AppData\Local\Temp\nsj892E.tmp\gb7ir8nsaimu39b.dll

Filesize
149KB

MD5
0c44ee25d7c510783d118d3f76d88b3b

SHA1
ff537d185513d1a2daf91ca5679c79f3c8346e9a

SHA256
0b54c2abb6bee336adc1866f128591a6e0d5fa0f90333f6a6b57205b41196e20

SHA512
a13490eb75a842e15ae33cb167209e76dbfb7b1fe96530ca3bd41ff2a4318717b53a5e44bb1f0f2523f38888e142061019082ffb11bc633953a773b25e2fc587

Download Submit
memory/2544-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-44-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-38-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-29-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-34-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2568-9-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2568-4-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing