remcos | 9d288f2ea49daa4323d1a496c42cbffdfbb148b634345ecc9147265bbdc43491

Analysis

max time kernel
150s
max time network
141s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

200630 Kloepfel Consulting GmbH.scr
Size

680KB
MD5

cd8d11d11a4a2c38bfb1ba89a9e8cef6
SHA1

27cdc50b73ce48a9d2e773fbda57fe11a67a1d40
SHA256

9d288f2ea49daa4323d1a496c42cbffdfbb148b634345ecc9147265bbdc43491
SHA512

d7efb6e34026658f0e098c028f7613ace62c36e5d10fd64185f5d5b1bb3d0d95e100e164512032d404c265c9ef448ff69c4c2055ad81a2bdff6f64d2972e27da

Score

10^/10

persistence rat remcos

Malware Config

Extracted

Family

remcos

coronanancy14-50163.portmap.io:50163

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

200630 Kloepfel Consulting GmbH.scr

description	pid	process	target process
PID 2564 wrote to memory of 672	2564	200630 Kloepfel Consulting GmbH.scr	ieinstal.exe
PID 2564 wrote to memory of 672	2564	200630 Kloepfel Consulting GmbH.scr	ieinstal.exe
PID 2564 wrote to memory of 672	2564	200630 Kloepfel Consulting GmbH.scr	ieinstal.exe
PID 2564 wrote to memory of 672	2564	200630 Kloepfel Consulting GmbH.scr	ieinstal.exe
PID 2564 wrote to memory of 672	2564	200630 Kloepfel Consulting GmbH.scr	ieinstal.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

200630 Kloepfel Consulting GmbH.scr

description pid process target process

PID 2564 set thread context of 672 2564 200630 Kloepfel Consulting GmbH.scr ieinstal.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ieinstal.exe

pid process

672 ieinstal.exe

description	pid	process	target process
PID 2564 set thread context of 672	2564	200630 Kloepfel Consulting GmbH.scr	ieinstal.exe

pid	process
672	ieinstal.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

200630 Kloepfel Consulting GmbH.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ydgn = "C:\\Users\\Admin\\AppData\\Local\\Ydgn\\Ydgn.hta"	200630 Kloepfel Consulting GmbH.scr

C:\Users\Admin\AppData\Local\Temp\200630 Kloepfel Consulting GmbH.scr
"C:\Users\Admin\AppData\Local\Temp\200630 Kloepfel Consulting GmbH.scr" /S
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:2564

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/672-1-0x0000000000413A84-mapping.dmp

Download
memory/672-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download