remcos | 18f32daab9bac5909cf9fe9bfaba3183104ae5ec60bdafc8091214887e966195

General

Target

Loading-Documents,pdf.exe
Size

423KB
MD5

4df66339be6f263c7c6e398cc65de65e
SHA1

6810fbf18ada8cdbc5d228c0db2bc01ca029fddf
SHA256

18f32daab9bac5909cf9fe9bfaba3183104ae5ec60bdafc8091214887e966195
SHA512

b0be3f88d7cde12e9fdb7f451f30b8b996c7eae12ad29bd8c313312af38c2b5d7f765da0af55d0554f04ff44f769a4cb8453b8f02e6c2e30914528f1fc609de8

Score

10^/10

rat remcos

Malware Config

Extracted

Family

remcos

C2

jamesanderson68986.ddns.net:1965

Signatures

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Loading-Documents,pdf.exe

description	pid	process	target process
PID 1460 wrote to memory of 292	1460	Loading-Documents,pdf.exe	schtasks.exe
PID 1460 wrote to memory of 292	1460	Loading-Documents,pdf.exe	schtasks.exe
PID 1460 wrote to memory of 292	1460	Loading-Documents,pdf.exe	schtasks.exe
PID 1460 wrote to memory of 292	1460	Loading-Documents,pdf.exe	schtasks.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe
PID 1460 wrote to memory of 1644	1460	Loading-Documents,pdf.exe	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Loading-Documents,pdf.exe

description pid process target process

PID 1460 set thread context of 1644 1460 Loading-Documents,pdf.exe vbc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1644 vbc.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

292 schtasks.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

description	pid	process	target process
PID 1460 set thread context of 1644	1460	Loading-Documents,pdf.exe	vbc.exe

pid	process
1644	vbc.exe

pid	process
292	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Loading-Documents,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Loading-Documents,pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1460

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fpFLXNdFua" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE7D.tmp"
2⤵
- Creates scheduled task(s)
PID:292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBE7D.tmp

Download Submit
memory/292-2-0x0000000000000000-mapping.dmp

Download
memory/1460-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1644-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1644-5-0x0000000000413B74-mapping.dmp

Download
memory/1644-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads