remcos | 9847787ffbd118169e46e25faf174e06acda93a9bd3a05253e395248a14c90e4

General

Target

10012025_1345_10012025_2025-10-01.rtf
Size

468KB
MD5

637a0dca5ff05243ce500f663899f348
SHA1

0a8dc1c0ebaa9a6543b49bc2c6546c48a89a92c8
SHA256

9847787ffbd118169e46e25faf174e06acda93a9bd3a05253e395248a14c90e4
SHA512

84eb867a3a83748deb213d485c5e2b7d2c2476b1bd34a59066a6930a9dc665e425675dd152cdbbbd94553af9c0e69149b12d5330bb8f7e775285298f876abc8c
SSDEEP

6144:bwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAi:5Tpy

Score

10^/10

remcos remotehost discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

www.kposlifestyle.design:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
edefdefffff
mouse_option
false
mutex
Rmc-OH1QS4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2772	EQNEDT32.EXE
7	2772	EQNEDT32.EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1788	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2560	firefoxplugni.exe
2092	firefoxplugni.exe

Loads dropped DLL 2 IoCs

pid	Process
2772	EQNEDT32.EXE
2772	EQNEDT32.EXE

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2560 set thread context of 2092	2560	firefoxplugni.exe	35

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EQNEDT32.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	firefoxplugni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	firefoxplugni.exe

Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
2772	EQNEDT32.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2412	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1788	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2412	WINWORD.EXE
2412	WINWORD.EXE
2092	firefoxplugni.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2560	2772	EQNEDT32.EXE	30
PID 2772 wrote to memory of 2560	2772	EQNEDT32.EXE	30
PID 2772 wrote to memory of 2560	2772	EQNEDT32.EXE	30
PID 2772 wrote to memory of 2560	2772	EQNEDT32.EXE	30
PID 2412 wrote to memory of 2176	2412	WINWORD.EXE	32
PID 2412 wrote to memory of 2176	2412	WINWORD.EXE	32
PID 2412 wrote to memory of 2176	2412	WINWORD.EXE	32
PID 2412 wrote to memory of 2176	2412	WINWORD.EXE	32
PID 2560 wrote to memory of 1788	2560	firefoxplugni.exe	33
PID 2560 wrote to memory of 1788	2560	firefoxplugni.exe	33
PID 2560 wrote to memory of 1788	2560	firefoxplugni.exe	33
PID 2560 wrote to memory of 1788	2560	firefoxplugni.exe	33
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35
PID 2560 wrote to memory of 2092	2560	firefoxplugni.exe	35

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10012025_1345_10012025_2025-10-01.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2176

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Roaming\firefoxplugni.exe
  "C:\Users\Admin\AppData\Roaming\firefoxplugni.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\firefoxplugni.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Users\Admin\AppData\Roaming\firefoxplugni.exe
    "C:\Users\Admin\AppData\Roaming\firefoxplugni.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\edefdefffff\logs.dat

Filesize
264B

MD5
6668e52c4d31de9f622a0e4143f6603c

SHA1
a3aaf5c18d9b4a26c9f9868ced3cc85b0d1ffb15

SHA256
98d69a6535bd6912739e6c960d310ae3987a231ca08572f5a0c18d6ec0cebd93

SHA512
de6e72612e724d6c06b683aff4610115de42581d4ede81019815b0cc4e7e3afa1b56f09e288b84f169aed3ccb508bca4c7f9bf026952c12183726fc015a5fd80

Download Submit
C:\Users\Admin\AppData\Roaming\firefoxplugni.exe

Filesize
958KB

MD5
c3a038325cbfffb65baa02b02f1eb72c

SHA1
430d5b577794b6732b46372361d7a7a7670a58ae

SHA256
4f8ffd67641fbb7206cc5b4fdfeed8839dc7a825e28c822e9d95327be9d55d27

SHA512
46871612fbd25f139269b7f65b6ae24440f480ee8d3b29525c1f58cb9a1e2b72642b931512d7f1da714415ae5949b4840a8bea217f2f7bb3c39155009dcb61ac

Download Submit
memory/2092-38-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-83-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2092-84-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-48-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-76-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-46-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-51-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-57-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-54-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-53-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-58-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-91-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-75-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-41-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-60-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-59-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-42-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-44-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-68-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2092-67-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2412-0-0x000000002F3F1000-0x000000002F3F2000-memory.dmp

Filesize
4KB

Download
memory/2412-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2412-2-0x000000007183D000-0x0000000071848000-memory.dmp

Filesize
44KB

Download
memory/2412-36-0x000000007183D000-0x0000000071848000-memory.dmp

Filesize
44KB

Download
memory/2560-37-0x0000000005E60000-0x0000000005F22000-memory.dmp

Filesize
776KB

Download
memory/2560-35-0x0000000000460000-0x000000000047A000-memory.dmp

Filesize
104KB

Download
memory/2560-30-0x00000000009F0000-0x0000000000AE4000-memory.dmp

Filesize
976KB

Download

Analysis

Sharing