remcos | c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d

General

Target
c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe
Size 645KB
Sample260917-yxbcvsbf96
SHA256 c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d
MD5 3a5d9e34221eac5e9d0626f1c265d8d3
SHA1 d0f8012052d068b79342440af23d2797213bbbd5
SHA512 ee12bdcb986dc8c5fd5b8947585aa01270da861bb353edff98359bf65c638bee6eda6a586a5a5e5d6c5249ca039c3b9b39a22ba9a708c057ea982e293fde78be
SSDEEP 12288:nIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:I5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T11CE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

C2

trangchuae888.com:8080
c2.trangchuae888.com:8080
backdoor.trangchuae888.com:8080
www.trangchuae888.com:8080

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
1
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
ay391stx
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
ay391stx
mouse_option
false
mutex
Rmc-HRVGON
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%Temp%
screenshot_time
2
startup_value
take_screenshot_option
true
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
4312	remcos.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-HRVGON = "\"C:\\ProgramData\\ay391stx\\remcos.exe\""	c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4312 set thread context of 3892	4312	remcos.exe	89
PID 3892 set thread context of 5972	3892	msedge.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3892	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4696	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4696	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3892	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3892	msedge.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4312	3512	c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe	88
PID 4312 wrote to memory of 3892	4312	remcos.exe	89
PID 3892 wrote to memory of 5972	3892	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe
"C:\Users\Admin\AppData\Local\Temp\c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3512
- C:\ProgramData\ay391stx\remcos.exe
  "C:\ProgramData\ay391stx\remcos.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4312
- - \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
    "c:\program files (x86)\microsoft\edge\application\msedge.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:5972

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\ay391stx\remcos.exe
Size 645KB
SHA256 c45749fcba433bc5b22bb7ae3a490d2b215dfc0f990a26893449a3063e08430d
MD5 3a5d9e34221eac5e9d0626f1c265d8d3
SHA1 d0f8012052d068b79342440af23d2797213bbbd5
SHA512 ee12bdcb986dc8c5fd5b8947585aa01270da861bb353edff98359bf65c638bee6eda6a586a5a5e5d6c5249ca039c3b9b39a22ba9a708c057ea982e293fde78be
SSDEEP 12288:nIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:I5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T11CE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3892-2-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3892-4-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3892-6-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3892-8-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/3892-10-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

memory/5972-3-0x0000000140000000-0x00000001400AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads