remcos | 1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20

General

Target
1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe
Size 626KB
Sample260820-spms2azdmf
SHA256 1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20
MD5 59d7c7cd3538a3474245fe939b593570
SHA1 6b19bd7ba26f57c92363ba818d07e1522db3613c
SHA512 61d310f1b851d279f38099809a73f0299c400c83914b0a134333d847f970e9ea730b17c38cc1db3e80a5fcb662534f7921a7a672ccf203866d3690508c45f903
SSDEEP 12288:CZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:cQKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T142D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost remcos xworm persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

RemoteHost

C2

15.204.115.143:2404
169.58.169.10:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-1A8F18
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

xworm

Version

5.0

C2

15.204.115.143:7004

Mutex

wIROdv22FfEbKReg

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5d1-8.dat	family_xworm

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\	1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-1A8F18 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe

Executes dropped EXE 2 IoCs

pid	Process
3388	remcos.exe
1852	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-1A8F18 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-1A8F18 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4468 set thread context of 4932	4468	1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4468	1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4932	4468	1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe	89
PID 4932 wrote to memory of 1852	4932	1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe	95

C:\Users\Admin\AppData\Local\Temp\1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe
"C:\Users\Admin\AppData\Local\Temp\1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe
  "C:\Users\Admin\AppData\Local\Temp\1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    PID:1852

C:\ProgramData\Remcos\remcos.exe
"C:\ProgramData\Remcos\remcos.exe"
1⤵
- Executes dropped EXE
PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 626KB
SHA256 1d4affd51731348d6cc3ccf5e029ea7ab6acd37145f254831351588649873d20
MD5 59d7c7cd3538a3474245fe939b593570
SHA1 6b19bd7ba26f57c92363ba818d07e1522db3613c
SHA512 61d310f1b851d279f38099809a73f0299c400c83914b0a134333d847f970e9ea730b17c38cc1db3e80a5fcb662534f7921a7a672ccf203866d3690508c45f903
SSDEEP 12288:CZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:cQKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T142D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

no analysis.exe

Path C:\Users\Admin\AppData\Local\Temp\no analysis.exe
Size 41KB
SHA256 0f0c8d17ae6b4fae8107459f9444c2eb9a9dd9e2a37f402b35ecddb6e0498297
MD5 fddfbf41b1926836df373f94bb5e28c9
SHA1 bc47e3e3447406c95d9b2da844061128648e327c
SHA512 f68911fa3cbf1a54be0232b0eda8f5426de7453f128c59af295940f3a0723bfdbaf13127b2f7b381ecaf9216b64bab0995e0278d1c8316e4576414bd605dddcd
SSDEEP 768:93vMgr4C+NhtrO8AP2Q2r1u2BwlE22Ff9VpZOCh/Jyh:Rv7rB+hrOTP2QgBwlElFf9VzOCl+
TLSH
T1D1137C08B7904216E9ED7BB559B363030A31F6078913CB5E0CD597AB2F67AC4CE417E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupr.exe

Path C:\Users\Admin\AppData\Local\Temp\startupr.exe
Size 626KB
SHA256 abf4860525b5302cd3bc4ba6a60f7b04ec801ed4729f3217b38680be7a7048f6
MD5 4acb621e1e5044c33c102c74fc9244cf
SHA1 ce8ca76ad0bf9906335980c373e854d70ec022f3
SHA512 a65ff2a19ebfc1225580d3835e90fa93d38e2a0580789b82fbec980b6d9ced3a7720fba28b8e81d279ec4f54dbb662895bc920f1709acf105100dbf1d95ac2e8
SSDEEP 12288:qZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5ZrF:UQKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T106D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4468-15-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/4468-12-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/4468-19-0x0000000180000000-0x000000018012D000-memory.dmp

Download

memory/4932-2-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4932-18-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads