remcos | 9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732

Analysis

max time kernel
149s
max time network
152s
platform
windows10_x64
resource
win10
submitted
24/06/2020, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe
Size 1.1MB
Sample200624-yh4y136e4x
SHA256 9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732
MD5 14016086871d244f3417d18db2975552
SHA1 b2072bcd75220c4d80bc9987b3f0376733812a30
SHA512 255f7034fa26ae2f540aebd2b19b8be826fca0a072401150fbe4a11010e76f7311caf22eb973d03670aaf6a94c19547aee11e1fadd5e5edb35e9d2139088bd2f
MD5 SHA1 SHA512

Score

10^/10

persistence rat remcos

Malware Config

Extracted

Family

remcos

daya4659.ddns.net:8282

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1380 created 1028	1380	WerFault.exe	75

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe
1380	WerFault.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2132	schtasks.exe
1644	schtasks.exe
756	schtasks.exe
1596	schtasks.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4036 set thread context of 3900	4036	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	67
PID 500 set thread context of 668	500	remcos.exe	74
PID 668 set thread context of 1028	668	remcos.exe	75
PID 4012 set thread context of 3792	4012	sfc.exe	81
PID 816 set thread context of 1068	816	sfc.exe	91

Executes dropped EXE 6 IoCs

pid	Process
500	remcos.exe
668	remcos.exe
4012	sfc.exe
3792	sfc.exe
816	sfc.exe
1068	sfc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	1028	WerFault.exe	75

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1380	WerFault.exe
Token: SeBackupPrivilege	1380	WerFault.exe
Token: SeDebugPrivilege	1380	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
668	remcos.exe

Adds Run entry to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 3900	4036	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	67
PID 4036 wrote to memory of 3900	4036	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	67
PID 4036 wrote to memory of 3900	4036	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	67
PID 4036 wrote to memory of 3900	4036	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	67
PID 4036 wrote to memory of 3900	4036	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	67
PID 4036 wrote to memory of 756	4036	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	68
PID 4036 wrote to memory of 756	4036	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	68
PID 4036 wrote to memory of 756	4036	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	68
PID 3900 wrote to memory of 428	3900	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	69
PID 3900 wrote to memory of 428	3900	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	69
PID 3900 wrote to memory of 428	3900	9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe	69
PID 428 wrote to memory of 3224	428	WScript.exe	71
PID 428 wrote to memory of 3224	428	WScript.exe	71
PID 428 wrote to memory of 3224	428	WScript.exe	71
PID 3224 wrote to memory of 500	3224	cmd.exe	73
PID 3224 wrote to memory of 500	3224	cmd.exe	73
PID 3224 wrote to memory of 500	3224	cmd.exe	73
PID 500 wrote to memory of 668	500	remcos.exe	74
PID 500 wrote to memory of 668	500	remcos.exe	74
PID 500 wrote to memory of 668	500	remcos.exe	74
PID 500 wrote to memory of 668	500	remcos.exe	74
PID 500 wrote to memory of 668	500	remcos.exe	74
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 668 wrote to memory of 1028	668	remcos.exe	75
PID 500 wrote to memory of 1596	500	remcos.exe	78
PID 500 wrote to memory of 1596	500	remcos.exe	78
PID 500 wrote to memory of 1596	500	remcos.exe	78
PID 4012 wrote to memory of 3792	4012	sfc.exe	81
PID 4012 wrote to memory of 3792	4012	sfc.exe	81
PID 4012 wrote to memory of 3792	4012	sfc.exe	81
PID 4012 wrote to memory of 3792	4012	sfc.exe	81
PID 4012 wrote to memory of 3792	4012	sfc.exe	81
PID 4012 wrote to memory of 2132	4012	sfc.exe	82
PID 4012 wrote to memory of 2132	4012	sfc.exe	82
PID 4012 wrote to memory of 2132	4012	sfc.exe	82
PID 816 wrote to memory of 1068	816	sfc.exe	91
PID 816 wrote to memory of 1068	816	sfc.exe	91
PID 816 wrote to memory of 1068	816	sfc.exe	91
PID 816 wrote to memory of 1068	816	sfc.exe	91
PID 816 wrote to memory of 1068	816	sfc.exe	91
PID 816 wrote to memory of 1644	816	sfc.exe	92
PID 816 wrote to memory of 1644	816	sfc.exe	92
PID 816 wrote to memory of 1644	816	sfc.exe	92

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
668	remcos.exe

C:\Users\Admin\AppData\Local\Temp\9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe
"C:\Users\Admin\AppData\Local\Temp\9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Local\Temp\9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe
  "C:\Users\Admin\AppData\Local\Temp\9709e49e5f7ab7bf5933008c4cabd439ee90a70f11276cbc5d9a010813557732.exe"
  2⤵
  - Adds Run entry to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3224
    - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:500
      - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        6⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Adds Run entry to start application
        Suspicious use of WriteProcessMemory
        Suspicious use of SetWindowsHookEx
        
        PID:668
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 576
        8⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Suspicious behavior: EnumeratesProcesses
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:1596
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:756

C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
1⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
  "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2132

C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
1⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
  "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-9-0x0000000000820000-0x0000000000840000-memory.dmp

Download

memory/1028-14-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/1028-12-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/1380-21-0x00000000047F0000-0x00000000047F1000-memory.dmp

Download

memory/1380-16-0x0000000004600000-0x0000000004601000-memory.dmp

Download

memory/3900-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download