remcos | 74c74bc92e1e2b1fbec04160533ddc46adfd8e2f691295ad4a08cbd83e01adc7

General

Target

purchase order for july.exe
Size

531KB
MD5

2b8ffa3d1e175136dbecbc64b2562294
SHA1

1f9f9a709fc9565ffea8b3f3a655a607aff03d28
SHA256

74c74bc92e1e2b1fbec04160533ddc46adfd8e2f691295ad4a08cbd83e01adc7
SHA512

be86d9ffca14908d42a7782664eb6eabc669c2b25ec6dd3ad332b934c860a7513773e6e85de1e084d3965ac839959b546a77dbf81e3526dc698e94386bc74802

Score

10^/10

persistence rat remcos

Malware Config

Extracted

Family

remcos

C2

194.5.97.18:6642

gozman11.duckdns.org:6642

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 2 IoCs

Processes:

purchase order for july.exechrome.exe

description	pid	process	target process
PID 3848 set thread context of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 3792 set thread context of 3924	3792	chrome.exe	chrome.exe

Executes dropped EXE 3 IoCs

Processes:

chrome.exechrome.exechrome.exe

pid process

3792 chrome.exe
3580 chrome.exe
3924 chrome.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

chrome.exe

description pid process

Token: SeDebugPrivilege 3792 chrome.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

chrome.exe

pid process

3924 chrome.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3504 PING.EXE

pid	process
3792	chrome.exe
3580	chrome.exe
3924	chrome.exe

description	pid	process
Token: SeDebugPrivilege	3792	chrome.exe

pid	process
3924	chrome.exe

pid	process
3504	PING.EXE

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

purchase order for july.exepurchase order for july.execmd.exechrome.exe

description	pid	process	target process
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	purchase order for july.exe
PID 2080 wrote to memory of 2576	2080	purchase order for july.exe	cmd.exe
PID 2080 wrote to memory of 2576	2080	purchase order for july.exe	cmd.exe
PID 2080 wrote to memory of 2576	2080	purchase order for july.exe	cmd.exe
PID 2576 wrote to memory of 3504	2576	cmd.exe	PING.EXE
PID 2576 wrote to memory of 3504	2576	cmd.exe	PING.EXE
PID 2576 wrote to memory of 3504	2576	cmd.exe	PING.EXE
PID 2576 wrote to memory of 3792	2576	cmd.exe	chrome.exe
PID 2576 wrote to memory of 3792	2576	cmd.exe	chrome.exe
PID 2576 wrote to memory of 3792	2576	cmd.exe	chrome.exe
PID 3792 wrote to memory of 3580	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3580	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3580	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3924	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3924	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3924	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3924	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3924	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3924	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3924	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3924	3792	chrome.exe	chrome.exe
PID 3792 wrote to memory of 3924	3792	chrome.exe	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3792 chrome.exe
3792 chrome.exe

pid	process
3792	chrome.exe
3792	chrome.exe

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

purchase order for july.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\	purchase order for july.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\chrome.exe\""	purchase order for july.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\chrome.exe\""	chrome.exe

C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe
"C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3848

C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
PID:2080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:3504

C:\Users\Admin\AppData\Roaming\remcos\chrome.exe
"C:\Users\Admin\AppData\Roaming\remcos\chrome.exe"
4⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:3792

C:\Users\Admin\AppData\Roaming\remcos\chrome.exe
"{path}"
5⤵
- Executes dropped EXE
PID:3580

C:\Users\Admin\AppData\Roaming\remcos\chrome.exe
"{path}"
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
PID:3924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\chrome.exe

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\chrome.exe

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\chrome.exe

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\chrome.exe

Download Submit
memory/2080-1-0x000000000040FD88-mapping.dmp

Download
memory/2080-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2080-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2576-3-0x0000000000000000-mapping.dmp

Download
memory/3504-5-0x0000000000000000-mapping.dmp

Download
memory/3792-7-0x0000000000000000-mapping.dmp

Download
memory/3792-6-0x0000000000000000-mapping.dmp

Download
memory/3924-12-0x000000000040FD88-mapping.dmp

Download
memory/3924-14-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads