remcos | 7677843a76323663063dc850d3b37baddb549afb037b06b8c0c2f26aa76e89bc

General

Target
tmpm333bdbs.exe
Size 1.4MB
Sample260601-13ptjsf19v
SHA256 7677843a76323663063dc850d3b37baddb549afb037b06b8c0c2f26aa76e89bc
MD5 ccee88276361c76d833b54ffaaf5b4fa
SHA1 91c02a8e231dd55500e2e896c698ed4d4cd1b37a
SHA512 5e62cdca8779491308b61b04f5aaa3a783019a2cdf9213350f661c66abf31c7fd426525ef56f0a941cbb8d83757aa58a5893526b67f12166bcd3164b7775ac0c
SSDEEP 12288:u6sM9oIoH10er5+nKL1Jer5+nqA1YaL8i0DMUNLtG4+tbQIzKYZLwwmer5+n:YeolH1GAVDKUTbQIzFLw
TLSH
T19665F657EB815AE8F69D09366B584150DB2EF221AB4F2360746C420CCF8738B8F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

host defense_evasion discovery remcos persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

lalalalalaalal.fr.to:2404
tdegreenffields.duckdns.org:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
sock.exe
copy_folder
socks
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_numnuqorsziptly
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	tmpm333bdbs.exe

Executes dropped EXE 2 IoCs

pid	Process
2104	sock.exe
2784	sock.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\socks\\sock.exe\""	sock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\socks\\sock.exe\""	tmpm333bdbs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpm333bdbs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2448	PING.EXE

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4244	reg.exe
620	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2448	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2104	sock.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 5112	5028	tmpm333bdbs.exe	86
PID 5112 wrote to memory of 4244	5112	cmd.exe	88
PID 5028 wrote to memory of 2672	5028	tmpm333bdbs.exe	89
PID 2672 wrote to memory of 2448	2672	cmd.exe	91
PID 2104 wrote to memory of 3204	2104	sock.exe	95
PID 3204 wrote to memory of 620	3204	cmd.exe	97
PID 2672 wrote to memory of 2784	2672	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\tmpm333bdbs.exe
"C:\Users\Admin\AppData\Local\Temp\tmpm333bdbs.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2448
- - C:\Users\Admin\AppData\Roaming\socks\sock.exe
    "C:\Users\Admin\AppData\Roaming\socks\sock.exe"
    3⤵
    - Executes dropped EXE
    PID:2784

C:\Users\Admin\AppData\Roaming\socks\sock.exe
"C:\Users\Admin\AppData\Roaming\socks\sock.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 96B
SHA256 360dc5189217080b080d527bc5777be8ed350a6a376cfd9652d5cc262938d894
MD5 091e28f09b0eab6c7472443390ff3cee
SHA1 85ea284ede95c367193424f7c028e750f5e0ce80
SHA512 0057c8ea391db71a23a018598f3bb2608812026deabf653a02b15b85dd207b7caaf2da9f5490ff2a94e106bfee55474696cfc0b4cfc1f9d788bcf683a3bd422a
TLSH
T111B0123608BC81AE5902451B0DF8F819E0118490760E34084A0808490566404FCD2400
MD5 SHA1 SHA512 TLSH

Submit Download

sock.exe

Path C:\Users\Admin\AppData\Roaming\socks\sock.exe
Size 1.4MB
SHA256 7677843a76323663063dc850d3b37baddb549afb037b06b8c0c2f26aa76e89bc
MD5 ccee88276361c76d833b54ffaaf5b4fa
SHA1 91c02a8e231dd55500e2e896c698ed4d4cd1b37a
SHA512 5e62cdca8779491308b61b04f5aaa3a783019a2cdf9213350f661c66abf31c7fd426525ef56f0a941cbb8d83757aa58a5893526b67f12166bcd3164b7775ac0c
SSDEEP 12288:u6sM9oIoH10er5+nKL1Jer5+nqA1YaL8i0DMUNLtG4+tbQIzKYZLwwmer5+n:YeolH1GAVDKUTbQIzFLw
TLSH
T19665F657EB815AE8F69D09366B584150DB2EF221AB4F2360746C420CCF8738B8F65E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads