remcos | abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9

General

Target
abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9.exe
Size 111KB
Sample261022-ynwmfafs3x
SHA256 abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9
MD5 ccd771ecdc72da24577684bade768563
SHA1 f3481e07c5c0447cd35383fec00bada0f259f4a8
SHA512 8a4c1e810dd3a5e99eb569c6177fe17aaff615f66b45a4f3246647e16add1089772ecdd6f0152d65b200c4cc81c71b1f314bc8e97379f2cdadf3b5ab52e821fe
SSDEEP 3072:juHq1twP/RbZwNDWB5noHMQ++PumNS2Z44OzqhCnr:juHqwP/FZwl6osQ++PumNS+ROzqhC
TLSH
T194B3E967E20B80A3D87302B056507B72EEBCBC321A5D5157E7E4D8811DF588E9066AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

talentino defense_evasion discovery execution remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

Talentino

C2

185.140.53.140:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
true
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-KG5D4I
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
6032	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
5944	remcos.exe
2452	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	remcos.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
6032	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2680	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	remcos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	remcos.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5944	remcos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 6032	3484	abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9.exe	90
PID 5944 wrote to memory of 1408	5944	remcos.exe	93
PID 6032 wrote to memory of 2680	6032	WScript.exe	94
PID 2680 wrote to memory of 2452	2680	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9.exe
"C:\Users\Admin\AppData\Local\Temp\abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Deletes itself
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
      4⤵
      Executes dropped EXE
      PID:2452

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Visual Basic

1

T1059.005

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 658B
SHA256 58e315880c5d867591aeb3fc742af4060cc82bfd98a277948d32be3afc7c11ee
MD5 9530925e951497df659cdea5d62b4976
SHA1 c7685eae36eeb977a2384b2fe8f545b5d82ee2e0
SHA512 584f3fb4e299480e3e040dcbaaa365e6300fe35fc2f14091a4a189343c445d8feab71ca8b2fcc15b4f0dd167b9159b947712a6bfe7dd1ee1ba810c527df37c80
TLSH
T1FA019624A6F81228F3F3AA45AEF554895D287731B817EE1D44C04A4D0C31E189C61B1E
MD5 SHA1 SHA512 TLSH

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 91B
SHA256 fbc36efcec14387ee219f0a1fbe9ed374af8961212d7b3ca27545de6055e035a
MD5 97fac8adfa6e37b3a370fbbb6710a6ba
SHA1 3383c8eb8f6eb93899e5135f751e87ba1d483917
SHA512 06569de5eaab8600ec79f4636097a4aea67a7911005b4187cd00ff77983957656eb0c41d10b378ba8d4808a0c61c6287cc79bec98210c2c67716e74307d823d4
TLSH
T168B0123557D153000055042D6A4091234A201C0B1486BF975241400511CE173C20328B
MD5 SHA1 SHA512 TLSH

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Size 111KB
SHA256 abb95a8d3c73265c132e301936759751062e495fe8c4740e36aba72cee12dba9
MD5 ccd771ecdc72da24577684bade768563
SHA1 f3481e07c5c0447cd35383fec00bada0f259f4a8
SHA512 8a4c1e810dd3a5e99eb569c6177fe17aaff615f66b45a4f3246647e16add1089772ecdd6f0152d65b200c4cc81c71b1f314bc8e97379f2cdadf3b5ab52e821fe
SSDEEP 3072:juHq1twP/RbZwNDWB5noHMQ++PumNS2Z44OzqhCnr:juHqwP/FZwl6osQ++PumNS+ROzqhC
TLSH
T194B3E967E20B80A3D87302B056507B72EEBCBC321A5D5157E7E4D8811DF588E9066AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads