remcos | 0d6de76b238cfc40e60c2838d908f06ff87f062078303746074dacb7edebaddd

General

Target
639d7892422191bea881223a7267fc41.exe
Size 487KB
Sample250619-rhjblawkt4
SHA256 0d6de76b238cfc40e60c2838d908f06ff87f062078303746074dacb7edebaddd
MD5 639d7892422191bea881223a7267fc41
SHA1 531073e929a7a86f77432567ac1b15e6a429b188
SHA512 6359df315b6708b4293b7d0f636e3ac2278a3976d2da276cc4c5395e0edd85ed19622be83a136f24bd8ab73cc03a7b02a9ad1f18bd2d7caa6f3d18449b8454a3
SSDEEP 12288:ovSPwdNnNZGA3/hvESbvqCqYH2v595OuVIsPZ3dL:oqPONnNZ33/VY42hnOmZN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.142.10.143:4444

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GRZVZH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Executes dropped EXE 2 IoCs

pid	Process
2808	remcos.exe
4056	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-GRZVZH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3706614508-2363726640-185459670-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-GRZVZH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	639d7892422191bea881223a7267fc41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-GRZVZH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	639d7892422191bea881223a7267fc41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3706614508-2363726640-185459670-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-GRZVZH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	639d7892422191bea881223a7267fc41.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2808	remcos.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 2808	5816	cmd.exe	82
PID 5816 wrote to memory of 2808	5816	cmd.exe	82
PID 5816 wrote to memory of 2808	5816	cmd.exe	82
PID 668 wrote to memory of 4056	668	639d7892422191bea881223a7267fc41.exe	83
PID 668 wrote to memory of 4056	668	639d7892422191bea881223a7267fc41.exe	83
PID 668 wrote to memory of 4056	668	639d7892422191bea881223a7267fc41.exe	83

C:\Users\Admin\AppData\Local\Temp\639d7892422191bea881223a7267fc41.exe
"C:\Users\Admin\AppData\Local\Temp\639d7892422191bea881223a7267fc41.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:668
- C:\ProgramData\Remcos\remcos.exe
  "C:\ProgramData\Remcos\remcos.exe"
  2⤵
  - Executes dropped EXE
  PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\Remcos\remcos.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5816
- C:\ProgramData\Remcos\remcos.exe
  C:\ProgramData\Remcos\remcos.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\Remcos\logs.dat
Size 168B
SHA256 2e6d2d3ae86072d670815a7dab56d0531aa49e9c30cc17ba92c8373761ff9178
MD5 aca025bcb6ff667d11ffc2b1adb8c34c
SHA1 6fad189257da15813d077b7e523a81bf26434993
SHA512 25dfe2b96f6f132686dc85ab9282562937bbc9cd4620784a780c0973f6ebce8bef6eff021f4ebc3c2c876048ce0edea7488020f76469ac0070839015830b022d
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 487KB
SHA256 0d6de76b238cfc40e60c2838d908f06ff87f062078303746074dacb7edebaddd
MD5 639d7892422191bea881223a7267fc41
SHA1 531073e929a7a86f77432567ac1b15e6a429b188
SHA512 6359df315b6708b4293b7d0f636e3ac2278a3976d2da276cc4c5395e0edd85ed19622be83a136f24bd8ab73cc03a7b02a9ad1f18bd2d7caa6f3d18449b8454a3
SSDEEP 12288:ovSPwdNnNZGA3/hvESbvqCqYH2v595OuVIsPZ3dL:oqPONnNZ33/VY42hnOmZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads