remcos | 13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5

General

Target
13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5.exe
Size 110KB
Sample260420-yvbwlsft7s
SHA256 13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5
MD5 4e5413b70273093f670c2d02e8f471c6
SHA1 a18e7ecb7cbbb57ce9f756117c625bff70283ab4
SHA512 c153531cb21eaf30c3f8f2ffc944133e5545f38b168236922ff7981fdff9fcd66dbd3300692b495de97811f03d8a814ea51a0a151e4c6799a949986f2ac481e9
SSDEEP 1536:UT2MQBOUgOqUo34sexjLBe/RPG/QlhZxY6V49YYzR2Ah3tHvtoY+zqh7lMRu/aoT:zMyOmqUbsv/RPNx1fYzRtt2Y+zQMRS
TLSH
T1CFB3E6077609D6F2F8B152B003946B569BBC6C230659A0A3C378D4811DB5D0AFE67AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.3.0 Pro

Botnet

RemoteHost

C2

daya4659.ddns.net:8282

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-S1KNPZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2896	remcos.exe
1300	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 5136	2896	remcos.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	remcos.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2944	1044	13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5.exe	79
PID 2896 wrote to memory of 5136	2896	remcos.exe	82
PID 2896 wrote to memory of 5136	2896	remcos.exe	82
PID 2896 wrote to memory of 5136	2896	remcos.exe	82
PID 2896 wrote to memory of 5136	2896	remcos.exe	82
PID 2896 wrote to memory of 5136	2896	remcos.exe	82
PID 2896 wrote to memory of 5136	2896	remcos.exe	82
PID 2896 wrote to memory of 5136	2896	remcos.exe	82
PID 2944 wrote to memory of 5308	2944	WScript.exe	83
PID 5308 wrote to memory of 1300	5308	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5.exe
"C:\Users\Admin\AppData\Local\Temp\13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5308
  - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      4⤵
      Executes dropped EXE
      PID:1300

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe
  2⤵
  PID:5136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416
MD5 ff449f6f7bc5e2d800eb30e2d2c56611
SHA1 93419ea805b9ce35a766e5c56db50d54c2d3f94b
SHA512 02a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6
TLSH
T1E4E08654A3FC1318F3F36A467DF5548A4D29B734A82BEB5D48800E4E5C71D18CC62F6A
MD5 SHA1 SHA512 TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 91B
SHA256 23c8cce6d1de6d19f962bdd23cb2579c966d6e3f4b7c31d8e96da57cbd6ef907
MD5 71f3a8038cfff1eee9a4cca0c9e88013
SHA1 0bbf68b6c1166155e1cb01329567ace5dfd7737f
SHA512 bbbc4b037fe8a41df08eb2ce7ebac720ea92eb3741e37509e84479cd25e5531757bba19a53b6161f0641be31cee4098b8c4f13a0c32732d615c06baeec91bbe1
TLSH
T1AAB01265CC6F7340744C022A2C1BC80C008D1520C42030501107C9C0D0D9D15A320301
MD5 SHA1 SHA512 TLSH

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Size 110KB
SHA256 13dedf60bfe5160a8c7f40b420b4df536d6a3b7ebd6309f5259f0efdd07490a5
MD5 4e5413b70273093f670c2d02e8f471c6
SHA1 a18e7ecb7cbbb57ce9f756117c625bff70283ab4
SHA512 c153531cb21eaf30c3f8f2ffc944133e5545f38b168236922ff7981fdff9fcd66dbd3300692b495de97811f03d8a814ea51a0a151e4c6799a949986f2ac481e9
SSDEEP 1536:UT2MQBOUgOqUo34sexjLBe/RPG/QlhZxY6V49YYzR2Ah3tHvtoY+zqh7lMRu/aoT:zMyOmqUbsv/RPNx1fYzRtt2Y+zQMRS
TLSH
T1CFB3E6077609D6F2F8B152B003946B569BBC6C230659A0A3C378D4811DB5D0AFE67AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5136-8-0x0000000000100000-0x0000000000120000-memory.dmp

Download

memory/5136-10-0x0000000000100000-0x0000000000120000-memory.dmp

Download

memory/5136-11-0x0000000000100000-0x0000000000120000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads