remcos | 8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223

General

Target
8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe
Size 370KB
Sample200706-fl49recten
SHA256 8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223
MD5 3bb68cebf78cd83c38dbb4cd33d2a407
SHA1 599400a2776f9b2cdb39fd179374db2e4b1ab8fc
SHA512 9f4f03f6a605ebf85731b1eaee2c2b2fbf441d264a7e31ee376b9363607bd08f31cda92142fcdfbc53e8aca44da7eb60f29d67212db5174e1b1190b5d657d949
MD5 SHA1 SHA512

Score

10^/10

persistence rat remcos

Malware Config

Extracted

Family

remcos

C2

185.140.53.37:1900

Signatures

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1560	1448	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	24
PID 1448 wrote to memory of 1560	1448	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	24
PID 1448 wrote to memory of 1560	1448	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	24
PID 1448 wrote to memory of 1560	1448	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	24
PID 1560 wrote to memory of 680	1560	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	25
PID 1560 wrote to memory of 680	1560	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	25
PID 1560 wrote to memory of 680	1560	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	25
PID 1560 wrote to memory of 680	1560	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	25
PID 1560 wrote to memory of 680	1560	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	25
PID 1560 wrote to memory of 680	1560	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	25
PID 1560 wrote to memory of 680	1560	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	25
PID 680 wrote to memory of 372	680	cmd.exe	27
PID 680 wrote to memory of 372	680	cmd.exe	27
PID 680 wrote to memory of 372	680	cmd.exe	27
PID 680 wrote to memory of 372	680	cmd.exe	27
PID 680 wrote to memory of 1124	680	cmd.exe	28
PID 680 wrote to memory of 1124	680	cmd.exe	28
PID 680 wrote to memory of 1124	680	cmd.exe	28
PID 680 wrote to memory of 1124	680	cmd.exe	28
PID 1124 wrote to memory of 1684	1124	remcos.exe	29
PID 1124 wrote to memory of 1684	1124	remcos.exe	29
PID 1124 wrote to memory of 1684	1124	remcos.exe	29
PID 1124 wrote to memory of 1684	1124	remcos.exe	29

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1448	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe
1124	remcos.exe

Loads dropped DLL 2 IoCs

pid	Process
680	cmd.exe
680	cmd.exe

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\remcos\\remcos.exe\""	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\remcos\\remcos.exe\""	remcos.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
372	PING.EXE

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1448	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe
1124	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 1560	1448	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe	24
PID 1124 set thread context of 1684	1124	remcos.exe	29

Executes dropped EXE 2 IoCs

pid	Process
1124	remcos.exe
1684	remcos.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\remcos\remcos.exe	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe
File opened for modification	C:\Windows\remcos\remcos.exe	8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe

C:\Users\Admin\AppData\Local\Temp\8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe
"C:\Users\Admin\AppData\Local\Temp\8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1448
- C:\Users\Admin\AppData\Local\Temp\8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe
  "C:\Users\Admin\AppData\Local\Temp\8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Adds Run entry to start application
  - Drops file in Windows directory
  PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    - Loads dropped DLL
    PID:680
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:372
  - - C:\Windows\remcos\remcos.exe
      "C:\Windows\remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      Suspicious behavior: MapViewOfSection
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetThreadContext
      Executes dropped EXE
      PID:1124
    - - C:\Windows\remcos\remcos.exe
        
        "C:\Windows\remcos\remcos.exe"
        5⤵
        Adds Run entry to start application
        Executes dropped EXE
        
        PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1560-2-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1684-15-0x0000000000400000-0x0000000000417000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads