remcos | 966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4

General

Target

966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
Size

1.9MB
MD5

2d68d3b9130925d7e5bc60ee9c7d153c
SHA1

1c3d2f0827b15fa6e7593ca1c5f2d745b1094019
SHA256

966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4
SHA512

2f23d4d8f2799d93f3977d42acb10ce317f94a53fd49005b637ccce0a4b0ba429053258880d8b564874bea36cdfa167f68798df2171b78518a6a45b39df07f61
SSDEEP

24576:9D39dlfGQrFUspugRNJI2DJnUw9W/j+BeKJWqwH6j1:9F+QrFUBgq25eKu6j1

Score

10^/10

remcos host discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Host

C2

213.183.58.19:4000

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
read.dat
keylog_flag
false
keylog_folder
CastC
keylog_path
%AppData%
mouse_option
false
mutex
remcos_sccafsoidz
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Executes dropped EXE 2 IoCs

pid	Process
2080	sbietrcl.exe
2492	sbietrcl.exe

Loads dropped DLL 1 IoCs

pid	Process
1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe"	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 2492	2080	sbietrcl.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sbietrcl.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
2080	sbietrcl.exe
2080	sbietrcl.exe
2080	sbietrcl.exe
2080	sbietrcl.exe
2080	sbietrcl.exe
2080	sbietrcl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
Token: SeDebugPrivilege	2080	sbietrcl.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2080	1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe	28
PID 1120 wrote to memory of 2080	1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe	28
PID 1120 wrote to memory of 2080	1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe	28
PID 1120 wrote to memory of 2080	1120	966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe	28
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29
PID 2080 wrote to memory of 2492	2080	sbietrcl.exe	29

C:\Users\Admin\AppData\Local\Temp\966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe
"C:\Users\Admin\AppData\Local\Temp\966aac44a4b149602aa9f300ba03e888164108c0d101feb75f5e5d94f4c1c5d4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
    3⤵
    - Executes dropped EXE
    PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03696ae8d815cf532618c10269d70962

SHA1
7a1baa2466f22ca98d357c312dd2a849d0316247

SHA256
3f0d4bb852307f7c7c0b336388004d012b91bd204c97bd0e745ebbc30ae9723a

SHA512
09f1caee6882a2a6e0a1223a51a9e7372490ed18ac5f6e992d0c1540fb3825f710146f7b07f4e53efabd472f0672f0a182d50e9a6bc6f2be61897d522b602ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab696D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Filesize
1.9MB

MD5
49d7b2c4f8d8813d04d320518a2ec838

SHA1
e36e0d00e4ebd5193f9ff3e976a0756261e9cf34

SHA256
851f5a868428461031873b5f3945ba5ae64a507cc2b4d3d87c242211164f83f7

SHA512
93a6fb7ea35c36c9adb44f8ebfc78004f541252836eb2c3d9dea381089e070b065254cfa9e3867fbbb57addceea70d69e66b4ff1c0ea9d6b181d2f95cc67e74c

Download Submit
memory/1120-0-0x0000000074871000-0x0000000074872000-memory.dmp

Filesize
4KB

Download
memory/1120-30-0x0000000074870000-0x0000000074E1B000-memory.dmp

Filesize
5.7MB

Download
memory/1120-12-0x0000000074870000-0x0000000074E1B000-memory.dmp

Filesize
5.7MB

Download
memory/1120-1-0x0000000074870000-0x0000000074E1B000-memory.dmp

Filesize
5.7MB

Download
memory/1120-11-0x0000000074870000-0x0000000074E1B000-memory.dmp

Filesize
5.7MB

Download
memory/2080-56-0x0000000074870000-0x0000000074E1B000-memory.dmp

Filesize
5.7MB

Download
memory/2080-31-0x0000000074870000-0x0000000074E1B000-memory.dmp

Filesize
5.7MB

Download
memory/2080-40-0x0000000074870000-0x0000000074E1B000-memory.dmp

Filesize
5.7MB

Download
memory/2080-41-0x0000000074870000-0x0000000074E1B000-memory.dmp

Filesize
5.7MB

Download
memory/2492-53-0x0000000000080000-0x0000000000097000-memory.dmp

Filesize
92KB

Download
memory/2492-47-0x0000000000080000-0x0000000000097000-memory.dmp

Filesize
92KB

Download
memory/2492-44-0x0000000000080000-0x0000000000097000-memory.dmp

Filesize
92KB

Download
memory/2492-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2492-46-0x0000000000080000-0x0000000000097000-memory.dmp

Filesize
92KB

Download
memory/2492-42-0x0000000000080000-0x0000000000097000-memory.dmp

Filesize
92KB

Download
memory/2492-48-0x0000000000080000-0x0000000000097000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads