remcos | c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d

General

Target
c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe
Size 645KB
Sample260917-yxbcvsbf96
SHA256 c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d
MD5 3a5d9e34221eac5e9d0626f1c265d8d3
SHA1 d0f8012052d068b79342440af23d2797213bbbd5
SHA512 ee12bdcb986dc8c5fd5b8947585aa01270da861bb353edff98359bf65c638bee6eda6a586a5a5e5d6c5249ca039c3b9b39a22ba9a708c057ea982e293fde78be
SSDEEP 12288:nIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:I5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T11CE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

trangchuae888.com:8080
c2.trangchuae888.com:8080
backdoor.trangchuae888.com:8080
www.trangchuae888.com:8080

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
1
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
ay391stx
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
ay391stx
mouse_option
false
mutex
Rmc-HRVGON
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%Temp%
screenshot_time
2
startup_value
take_screenshot_option
true
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe

Executes dropped EXE 1 IoCs

pid	Process
792	remcos.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 1520	792	remcos.exe	86
PID 1520 set thread context of 4908	1520	iexplore.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1252	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1252	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 792	1472	c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe	85
PID 792 wrote to memory of 1520	792	remcos.exe	86
PID 1520 wrote to memory of 4908	1520	iexplore.exe	89

C:\Users\Admin\AppData\Local\Temp\c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe
"C:\Users\Admin\AppData\Local\Temp\c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1472
- C:\ProgramData\ay391stx\remcos.exe
  "C:\ProgramData\ay391stx\remcos.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:792
- - \??\c:\program files\internet explorer\iexplore.exe
    "c:\program files\internet explorer\iexplore.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:4908

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x4e0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\ay391stx\remcos.exe
Size 645KB
SHA256 c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d
MD5 3a5d9e34221eac5e9d0626f1c265d8d3
SHA1 d0f8012052d068b79342440af23d2797213bbbd5
SHA512 ee12bdcb986dc8c5fd5b8947585aa01270da861bb353edff98359bf65c638bee6eda6a586a5a5e5d6c5249ca039c3b9b39a22ba9a708c057ea982e293fde78be
SSDEEP 12288:nIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:I5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T11CE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-8-0x0000020AF2460000-0x0000020AF250F000-memory.dmp

Download

memory/1520-11-0x0000020AF2460000-0x0000020AF250F000-memory.dmp

Download

memory/1520-13-0x0000020AF2460000-0x0000020AF250F000-memory.dmp

Download

memory/1520-15-0x0000020AF2460000-0x0000020AF250F000-memory.dmp

Download

memory/1520-17-0x0000020AF2460000-0x0000020AF250F000-memory.dmp

Download

memory/1520-19-0x0000020AF2460000-0x0000020AF250F000-memory.dmp

Download

memory/4908-12-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads