remcos | 74c74bc92e1e2b1fbec04160533ddc46adfd8e2f691295ad4a08cbd83e01adc7

Analysis

max time kernel
148s
max time network
151s
platform
windows10_x64
resource
win10v200430
submitted
09/07/2020, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

purchase order for july.exe
Size

531KB
MD5

2b8ffa3d1e175136dbecbc64b2562294
SHA1

1f9f9a709fc9565ffea8b3f3a655a607aff03d28
SHA256

74c74bc92e1e2b1fbec04160533ddc46adfd8e2f691295ad4a08cbd83e01adc7
SHA512

be86d9ffca14908d42a7782664eb6eabc669c2b25ec6dd3ad332b934c860a7513773e6e85de1e084d3965ac839959b546a77dbf81e3526dc698e94386bc74802

Score

10^/10

persistence rat remcos

Malware Config

Extracted

Family

remcos

194.5.97.18:6642

gozman11.duckdns.org:6642

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 2080	3848	purchase order for july.exe	72
PID 3792 set thread context of 3924	3792	chrome.exe	78

Executes dropped EXE 3 IoCs

pid	Process
3792	chrome.exe
3580	chrome.exe
3924	chrome.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3924	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3504	PING.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	72
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	72
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	72
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	72
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	72
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	72
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	72
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	72
PID 3848 wrote to memory of 2080	3848	purchase order for july.exe	72
PID 2080 wrote to memory of 2576	2080	purchase order for july.exe	73
PID 2080 wrote to memory of 2576	2080	purchase order for july.exe	73
PID 2080 wrote to memory of 2576	2080	purchase order for july.exe	73
PID 2576 wrote to memory of 3504	2576	cmd.exe	75
PID 2576 wrote to memory of 3504	2576	cmd.exe	75
PID 2576 wrote to memory of 3504	2576	cmd.exe	75
PID 2576 wrote to memory of 3792	2576	cmd.exe	76
PID 2576 wrote to memory of 3792	2576	cmd.exe	76
PID 2576 wrote to memory of 3792	2576	cmd.exe	76
PID 3792 wrote to memory of 3580	3792	chrome.exe	77
PID 3792 wrote to memory of 3580	3792	chrome.exe	77
PID 3792 wrote to memory of 3580	3792	chrome.exe	77
PID 3792 wrote to memory of 3924	3792	chrome.exe	78
PID 3792 wrote to memory of 3924	3792	chrome.exe	78
PID 3792 wrote to memory of 3924	3792	chrome.exe	78
PID 3792 wrote to memory of 3924	3792	chrome.exe	78
PID 3792 wrote to memory of 3924	3792	chrome.exe	78
PID 3792 wrote to memory of 3924	3792	chrome.exe	78
PID 3792 wrote to memory of 3924	3792	chrome.exe	78
PID 3792 wrote to memory of 3924	3792	chrome.exe	78
PID 3792 wrote to memory of 3924	3792	chrome.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	chrome.exe
3792	chrome.exe

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\	purchase order for july.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\chrome.exe\""	purchase order for july.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\chrome.exe\""	chrome.exe

C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe
"C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Adds Run entry to start application
  PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3504
  - - C:\Users\Admin\AppData\Roaming\remcos\chrome.exe
      "C:\Users\Admin\AppData\Roaming\remcos\chrome.exe"
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      Suspicious behavior: EnumeratesProcesses
      PID:3792
    - - C:\Users\Admin\AppData\Roaming\remcos\chrome.exe
        
        "{path}"
        5⤵
        Executes dropped EXE
        
        PID:3580
    - - C:\Users\Admin\AppData\Roaming\remcos\chrome.exe
        
        "{path}"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Adds Run entry to start application
        
        PID:3924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2080-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3924-14-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download