remcos | 5c8ef3cc03f446dfd1a1438dc45c81f3cd16679e04a19d85b9318692429a8239

General

Target

Payment Issue INV-202578_Pmt Ref_47734v8.exe
Size

620KB
MD5

c61384f6fa6286ff89e1f446cc25adb3
SHA1

3bf45b971bd7dc54c1eaa9f2c55d58c64ca7913e
SHA256

5c8ef3cc03f446dfd1a1438dc45c81f3cd16679e04a19d85b9318692429a8239
SHA512

576ec78e6b5f05912ee448f493c51332198f37166646abef36ca77880816c2ba7850ee57ca844b276e393804f5307bc4198805b9d6748e29dd747b8288ea86d7
SSDEEP

12288:uNvQ534LijMVuiZQ7hPGXC6TR4kliDxv:uNYhLv3NGXRR4Rdv

Score

10^/10

remcos googlegroupaccount discovery rat

Malware Config

Extracted

Family

remcos

Botnet

googlegroupaccount

C2

107.174.65.146:1194

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
googlegroupaccount.exe
copy_folder
googlegroupaccount
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%Temp%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-1MDOQC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Downloads MZ/PE file 1 IoCs

flow	pid	Process
36	1076	Process not Found

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3376 set thread context of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4028	408	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payment Issue INV-202578_Pmt Ref_47734v8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4444	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88
PID 3376 wrote to memory of 408	3376	Payment Issue INV-202578_Pmt Ref_47734v8.exe	88

C:\Users\Admin\AppData\Local\Temp\Payment Issue INV-202578_Pmt Ref_47734v8.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Issue INV-202578_Pmt Ref_47734v8.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\Payment Issue INV-202578_Pmt Ref_47734v8.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Issue INV-202578_Pmt Ref_47734v8.exe"
  2⤵
  PID:408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 512
    3⤵
    - Program crash
    PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 408 -ip 408
1⤵
PID:4832

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjVFNzhCRDItNzQ2OS00Q0E4LTlBMEQtNjhDNzRDQjNCN0E5fSIgdXNlcmlkPSJ7N0Y5Rjk2NzEtNjNEMy00Q0U0LUEwQ0EtOTBBRDFBMzlFQjc4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzZDNEMxMUMtN0ZBRi00ODBCLUIzNjQtNTEzNjFFQjVFRjkwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzMzNDkyMDMxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-9-0x00000000007C0000-0x0000000000840000-memory.dmp

Filesize
512KB

Download
memory/408-6-0x00000000007C0000-0x0000000000840000-memory.dmp

Filesize
512KB

Download
memory/408-14-0x00000000007C0000-0x0000000000840000-memory.dmp

Filesize
512KB

Download
memory/3376-0-0x0000000073E3E000-0x0000000073E3F000-memory.dmp

Filesize
4KB

Download
memory/3376-1-0x0000000000980000-0x0000000000A22000-memory.dmp

Filesize
648KB

Download
memory/3376-2-0x0000000005890000-0x0000000005E34000-memory.dmp

Filesize
5.6MB

Download
memory/3376-3-0x0000000073E30000-0x00000000745E0000-memory.dmp

Filesize
7.7MB

Download
memory/3376-15-0x0000000073E30000-0x00000000745E0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing