remcos | 425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab

General

Target

425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe
Size

981KB
MD5

164b1d640db37d9f5c95c23d816ffd69
SHA1

5fff09a87a47d38077a08aa917bab542e8317682
SHA256

425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab
SHA512

067bb44a7871b2ea63780cc2a3ea01000d742490b1e65e3211fbd9f3c004d03002689a4575077cc6a34ff36af073897afad0d526f5fc9aecb05b491143370df6
SSDEEP

24576:ubmYZg5hIgJsKsVWArhOX79ObyTUk9GgnAn1bij:w9JgEWymbTU1gk0j

Score

10^/10

remcos remcohost discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemcoHost

C2

31.13.224.237:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-VETI36
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2732	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2732	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2732	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	30
PID 2900 wrote to memory of 2732	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	30
PID 2900 wrote to memory of 2732	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	30
PID 2900 wrote to memory of 2732	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	30
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32
PID 2900 wrote to memory of 2616	2900	425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe	32

C:\Users\Admin\AppData\Local\Temp\425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe
"C:\Users\Admin\AppData\Local\Temp\425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe
  "C:\Users\Admin\AppData\Local\Temp\425fae95f11030526dd3a7e8dd94e93a52146be446be6095a96f1af53b13deab.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2616-15-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-32-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-39-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-38-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-37-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-36-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-35-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-13-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-8-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-14-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-20-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-23-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-34-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-12-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-18-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-33-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-31-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-21-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-11-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-27-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-28-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-29-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2616-30-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2900-7-0x0000000005080000-0x0000000005142000-memory.dmp

Filesize
776KB

Download
memory/2900-1-0x0000000000180000-0x000000000027C000-memory.dmp

Filesize
1008KB

Download
memory/2900-3-0x0000000004F90000-0x0000000005082000-memory.dmp

Filesize
968KB

Download
memory/2900-24-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/2900-6-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/2900-5-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download
memory/2900-4-0x00000000005C0000-0x00000000005DC000-memory.dmp

Filesize
112KB

Download
memory/2900-0-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download
memory/2900-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing