remcos | db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4

General

Target
db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
Size 110KB
Sample260419-yps8psev3w
SHA256 db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4
MD5 d8365c9e9c5d3846b8f31e9b6cc63d55
SHA1 c99d8ecbd053ef48a5c9a00ca8089a7f61892167
SHA512 ba6834333be0656454bcc349924c8395869227482bd329b0d28b4f117f63eddce829a1352087f24bb5e7b42e5ef825ab08836809853403a84f4571449d0a0882
SSDEEP 3072:Tq+jasXQP08qSUoP3AYVl76gjPdlCMGkONocweNXj2Y+zQMxS:W+jaaQlqS7PAYLBINocweNXjT+zQMxS
TLSH
T198B3FA57F34686A2E81603B107817FA6EBBCBC360A6D7153C388D1811D75C9BE065ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.3.0 Pro

Botnet

RemoteHost

C2

daya4659.ddns.net:8282

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-S1KNPZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
4164	remcos.exe
4556	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4164	remcos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 2448	3808	db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe	80
PID 4164 wrote to memory of 3704	4164	remcos.exe	83
PID 2448 wrote to memory of 2948	2448	WScript.exe	84
PID 2948 wrote to memory of 4556	2948	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe
"C:\Users\Admin\AppData\Local\Temp\db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      4⤵
      Executes dropped EXE
      PID:4556

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe
  2⤵
  PID:3704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416
MD5 ff449f6f7bc5e2d800eb30e2d2c56611
SHA1 93419ea805b9ce35a766e5c56db50d54c2d3f94b
SHA512 02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6
TLSH
T1E4E08654A3FC1318F3F36A467DF5548A4D29B734A82BEB5D48800E4E5C71D18CC62F6A
MD5 SHA1 SHA512 TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 91B
SHA256 1db365cda184c43dc1e95a63f17c0f76b51156bd7e14ec94758b08ec51f8e885
MD5 32e5df1c70fe21c4d395dab02574b2c1
SHA1 918f53c5db79214aae38e26438bcaa58e04ce30c
SHA512 1e8c4bef24b5f42ececf9eb59b57af441cc7061ef0f58106975e1edd632af6100bdffb76e54911aef5eee64ef3b6e6eaba6c3a7261cc6830feab5fbe5aca9c30
TLSH
T1CDB01258CC5D6240790C01661C1FCD08008A0020C82020A0100B85C1D4C9D299300202
MD5 SHA1 SHA512 TLSH

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Size 110KB
SHA256 db5e77fb8366ce2fe33da535ec996fa4f9c03f601b06b1655b00dbb61d64a4b4
MD5 d8365c9e9c5d3846b8f31e9b6cc63d55
SHA1 c99d8ecbd053ef48a5c9a00ca8089a7f61892167
SHA512 ba6834333be0656454bcc349924c8395869227482bd329b0d28b4f117f63eddce829a1352087f24bb5e7b42e5ef825ab08836809853403a84f4571449d0a0882
SSDEEP 3072:Tq+jasXQP08qSUoP3AYVl76gjPdlCMGkONocweNXj2Y+zQMxS:W+jaaQlqS7PAYLBINocweNXjT+zQMxS
TLSH
T198B3FA57F34686A2E81603B107817FA6EBBCBC360A6D7153C388D1811D75C9BE065ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads