remcos | 0d6de76b238cfc40e60c2838d908f06ff87f062078303746074dacb7edebaddd

General

Target
639d7892422191bea881223a7267fc41.exe
Size 487KB
Sample250619-rhjblawkt4
SHA256 0d6de76b238cfc40e60c2838d908f06ff87f062078303746074dacb7edebaddd
MD5 639d7892422191bea881223a7267fc41
SHA1 531073e929a7a86f77432567ac1b15e6a429b188
SHA512 6359df315b6708b4293b7d0f636e3ac2278a3976d2da276cc4c5395e0edd85ed19622be83a136f24bd8ab73cc03a7b02a9ad1f18bd2d7caa6f3d18449b8454a3
SSDEEP 12288:ovSPwdNnNZGA3/hvESbvqCqYH2v595OuVIsPZ3dL:oqPONnNZ33/VY42hnOmZN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.142.10.143:4444

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GRZVZH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\International\Geo\Nation	639d7892422191bea881223a7267fc41.exe

Executes dropped EXE 2 IoCs

pid	Process
2744	remcos.exe
5240	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-GRZVZH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-GRZVZH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	639d7892422191bea881223a7267fc41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-GRZVZH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	639d7892422191bea881223a7267fc41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-GRZVZH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	639d7892422191bea881223a7267fc41.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2744	remcos.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 2744	4776	cmd.exe	86
PID 4776 wrote to memory of 2744	4776	cmd.exe	86
PID 4776 wrote to memory of 2744	4776	cmd.exe	86
PID 3340 wrote to memory of 5240	3340	639d7892422191bea881223a7267fc41.exe	87
PID 3340 wrote to memory of 5240	3340	639d7892422191bea881223a7267fc41.exe	87
PID 3340 wrote to memory of 5240	3340	639d7892422191bea881223a7267fc41.exe	87

C:\Users\Admin\AppData\Local\Temp\639d7892422191bea881223a7267fc41.exe
"C:\Users\Admin\AppData\Local\Temp\639d7892422191bea881223a7267fc41.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340
- C:\ProgramData\Remcos\remcos.exe
  "C:\ProgramData\Remcos\remcos.exe"
  2⤵
  - Executes dropped EXE
  PID:5240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\Remcos\remcos.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\ProgramData\Remcos\remcos.exe
  C:\ProgramData\Remcos\remcos.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\Remcos\logs.dat
Size 168B
SHA256 bdfa8c5b31a5476ea41240af0eeb4bb38dd78fac369a4f2a87336d3c2e9a2645
MD5 6fc152ca21492566ab815edd19311023
SHA1 4f3686263a99cb2b7baadb92c42c8a99a17f6f65
SHA512 5b49d3f957ade03066aee5125c2ecd6ac23d21af5b56c0423f539cbce65859e599edb8649e90c269f26fb0aa636c1554d043a770b3915d8e9d893e13be08ec12
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 487KB
SHA256 0d6de76b238cfc40e60c2838d908f06ff87f062078303746074dacb7edebaddd
MD5 639d7892422191bea881223a7267fc41
SHA1 531073e929a7a86f77432567ac1b15e6a429b188
SHA512 6359df315b6708b4293b7d0f636e3ac2278a3976d2da276cc4c5395e0edd85ed19622be83a136f24bd8ab73cc03a7b02a9ad1f18bd2d7caa6f3d18449b8454a3
SSDEEP 12288:ovSPwdNnNZGA3/hvESbvqCqYH2v595OuVIsPZ3dL:oqPONnNZ33/VY42hnOmZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads