remcos | db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4

General

Target
db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
Size 110KB
Sample260419-yps8psev3w
SHA256 db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4
MD5 d8365c9e9c5d3846b8f31e9b6cc63d55
SHA1 c99d8ecbd053ef48a5c9a00ca8089a7f61892167
SHA512 ba6834333be0656454bcc349924c8395869227482bd329b0d28b4f117f63eddce829a1352087f24bb5e7b42e5ef825ab08836809853403a84f4571449d0a0882
SSDEEP 3072:Tq+jasXQP08qSUoP3AYVl76gjPdlCMGkONocweNXj2Y+zQMxS:W+jaaQlqS7PAYLBINocweNXjT+zQMxS
TLSH
T198B3FA57F34686A2E81603B107817FA6EBBCBC360A6D7153C388D1811D75C9BE065ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.3.0 Pro

Botnet

RemoteHost

C2

daya4659.ddns.net:8282

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-S1KNPZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
4444	remcos.exe
6016	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4444 set thread context of 4464	4444	remcos.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4444	remcos.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4344	4220	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe	84
PID 4444 wrote to memory of 4464	4444	remcos.exe	87
PID 4444 wrote to memory of 4464	4444	remcos.exe	87
PID 4444 wrote to memory of 4464	4444	remcos.exe	87
PID 4444 wrote to memory of 4464	4444	remcos.exe	87
PID 4444 wrote to memory of 4464	4444	remcos.exe	87
PID 4444 wrote to memory of 4464	4444	remcos.exe	87
PID 4444 wrote to memory of 4464	4444	remcos.exe	87
PID 4344 wrote to memory of 5900	4344	WScript.exe	88
PID 5900 wrote to memory of 6016	5900	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
"C:\Users\Admin\AppData\Local\Temp\db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5900
  - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      4⤵
      Executes dropped EXE
      PID:6016

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe
  2⤵
  PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416
MD5 ff449f6f7bc5e2d800eb30e2d2c56611
SHA1 93419ea805b9ce35a766e5c56db50d54c2d3f94b
SHA512 02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6
TLSH
T1E4E08654A3FC1318F3F36A467DF5548A4D29B734A82BEB5D48800E4E5C71D18CC62F6A
MD5 SHA1 SHA512 TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 91B
SHA256 f2397d607c644261e0e282767d118a6d6bcb2c7e376e9a3792c7012bcd22a95a
MD5 fe3a91ec4797692e3a2655469b911011
SHA1 db4e3280e15923a7864e3a65f16ac40593ff0189
SHA512 c67ea6ee6fc4386fa650ed62d10aec5d2b5ec3941fa07dfd2f7668a446bf67019596611e1990ce2b8d5d994b3540daf9cfcdb4ffe61ea217c0ff9fa562c06d52
TLSH
T1B5B01268CC5D6240784C01662C1FCC0800890120D82020A0100B89C0D0C9D299300201
MD5 SHA1 SHA512 TLSH

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Size 110KB
SHA256 db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4
MD5 d8365c9e9c5d3846b8f31e9b6cc63d55
SHA1 c99d8ecbd053ef48a5c9a00ca8089a7f61892167
SHA512 ba6834333be0656454bcc349924c8395869227482bd329b0d28b4f117f63eddce829a1352087f24bb5e7b42e5ef825ab08836809853403a84f4571449d0a0882
SSDEEP 3072:Tq+jasXQP08qSUoP3AYVl76gjPdlCMGkONocweNXj2Y+zQMxS:W+jaaQlqS7PAYLBINocweNXjT+zQMxS
TLSH
T198B3FA57F34686A2E81603B107817FA6EBBCBC360A6D7153C388D1811D75C9BE065ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4344-12-0x0000000002F20000-0x0000000002F39000-memory.dmp

Download

memory/4464-8-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4464-11-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4464-10-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads