remcos | 9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624

General

Target
9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624.exe
Size 111KB
Sample261020-zvmhsawsbt
SHA256 9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624
MD5 008c662d47890ce97cbeb0505eed7012
SHA1 8c1c6e28db5772c376ef24a08a3a9b8731ca465c
SHA512 a6f3c6c12d63433d10dd63d20a11317c6bb06a55020b7bde810b60124514ae7104752762e91696c4ec4b20fcaefcd6ec0274485c7ac17332987a187ced697dd4
SSDEEP 3072:YuHq1twP/RbZwNDWB5noHMQ++PumNSvt44OzqhCnr:YuHqwP/FZwl6osQ++PumNSFROzqhC
TLSH
T1E4B3E867E20B80A3D87302B056507B72EEBCBC321A5D5157E7E4D8811DF588E9066AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

talentino defense_evasion discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

Talentino

C2

185.140.53.140:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
true
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-KG5D4I
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4020	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2320	remcos.exe
1716	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	remcos.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4020	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	remcos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	remcos.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2320	remcos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 4020	6112	9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624.exe	88
PID 2320 wrote to memory of 5096	2320	remcos.exe	91
PID 4020 wrote to memory of 4532	4020	WScript.exe	92
PID 4532 wrote to memory of 1716	4532	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624.exe
"C:\Users\Admin\AppData\Local\Temp\9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Deletes itself
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      4⤵
      Executes dropped EXE
      PID:1716

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Visual Basic

1

T1059.005

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 658B
SHA256 066e33ed314049aacf9d3bf80bfa9b5ebfec458f72640d1e928d4952ce3a54f9
MD5 ec1c874b62a8fa4e3eeade65bab51018
SHA1 2a688ba0dc763824bdeb7b40605bcf74cdc0f0fd
SHA512 bacb10d54eada51d1870ce98d7571b781dd6d2af46cc16dd7e3e3d691f283176e7241a7a720c1709dbd42cdf31bd9f8a01004a4c69ac9d6fe11aeb0a7fdeff6b
TLSH
T100019028A6E81229F3F7AE556DF5004B9D79B630B817EA1D44C14B8D0C31E289D62B6E
MD5 SHA1 SHA512 TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 91B
SHA256 2a3c568594cc1f04bee649860f33b71104af869d0076d25a222eecfe66eb8718
MD5 ac22ecffe2678633d06e57c0d26fbc45
SHA1 62c78e67ba2878233e213838cab52ac101c7a8f7
SHA512 45c4f0e33ac9829b480dc76436fdcd9b517bca15387d9b558b1f5b3d3f6e1368a083eb104d9ba3b38bc746099a3446036f52552f26f76698bbd29b400a8e150c
TLSH
T186B0127553A051050054052D6940C2238A201D0E1582EF975341400A10CE193C283287
MD5 SHA1 SHA512 TLSH

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Size 111KB
SHA256 9f4c98b0c70d151a57d41dec70bc115a20edfeb7659025022765ef7d6efc6624
MD5 008c662d47890ce97cbeb0505eed7012
SHA1 8c1c6e28db5772c376ef24a08a3a9b8731ca465c
SHA512 a6f3c6c12d63433d10dd63d20a11317c6bb06a55020b7bde810b60124514ae7104752762e91696c4ec4b20fcaefcd6ec0274485c7ac17332987a187ced697dd4
SSDEEP 3072:YuHq1twP/RbZwNDWB5noHMQ++PumNSvt44OzqhCnr:YuHqwP/FZwl6osQ++PumNSFROzqhC
TLSH
T1E4B3E867E20B80A3D87302B056507B72EEBCBC321A5D5157E7E4D8811DF588E9066AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads