remcos | f412da03defe68cc6e1f264449adf519a4c5470c51e7b502854f7fbf358f8516

General

Target

34cad56539e803ceb0148995edde88a1.exe
Size

646KB
MD5

34cad56539e803ceb0148995edde88a1
SHA1

5b3b216e3ab8b5223534e5dc7e545604740d9951
SHA256

f412da03defe68cc6e1f264449adf519a4c5470c51e7b502854f7fbf358f8516
SHA512

4a3c6c7de06af36d2fef785f2af170b5edafdab5963e9d520f58c5e5a119fc65e683347c831b3664b71bcf3b84099028ada3c492057214711dda60e861558dda

Score

10^/10

persistence rat remcos

Malware Config

Extracted

Family

remcos

C2

185.140.53.209:1990

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1552	1464	34cad56539e803ceb0148995edde88a1.exe	24
PID 1508 set thread context of 1788	1508	chrome.exe	29

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\localhost = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrome.exe\""	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\	34cad56539e803ceb0148995edde88a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\localhost = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrome.exe\""	34cad56539e803ceb0148995edde88a1.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1464	34cad56539e803ceb0148995edde88a1.exe
1508	chrome.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1464	34cad56539e803ceb0148995edde88a1.exe
1508	chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
1040	cmd.exe
1040	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1508	chrome.exe
1788	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1788	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1552	1464	34cad56539e803ceb0148995edde88a1.exe	24
PID 1464 wrote to memory of 1552	1464	34cad56539e803ceb0148995edde88a1.exe	24
PID 1464 wrote to memory of 1552	1464	34cad56539e803ceb0148995edde88a1.exe	24
PID 1464 wrote to memory of 1552	1464	34cad56539e803ceb0148995edde88a1.exe	24
PID 1552 wrote to memory of 784	1552	34cad56539e803ceb0148995edde88a1.exe	25
PID 1552 wrote to memory of 784	1552	34cad56539e803ceb0148995edde88a1.exe	25
PID 1552 wrote to memory of 784	1552	34cad56539e803ceb0148995edde88a1.exe	25
PID 1552 wrote to memory of 784	1552	34cad56539e803ceb0148995edde88a1.exe	25
PID 784 wrote to memory of 1040	784	WScript.exe	26
PID 784 wrote to memory of 1040	784	WScript.exe	26
PID 784 wrote to memory of 1040	784	WScript.exe	26
PID 784 wrote to memory of 1040	784	WScript.exe	26
PID 1040 wrote to memory of 1508	1040	cmd.exe	28
PID 1040 wrote to memory of 1508	1040	cmd.exe	28
PID 1040 wrote to memory of 1508	1040	cmd.exe	28
PID 1040 wrote to memory of 1508	1040	cmd.exe	28
PID 1508 wrote to memory of 1788	1508	chrome.exe	29
PID 1508 wrote to memory of 1788	1508	chrome.exe	29
PID 1508 wrote to memory of 1788	1508	chrome.exe	29
PID 1508 wrote to memory of 1788	1508	chrome.exe	29

C:\Users\Admin\AppData\Local\Temp\34cad56539e803ceb0148995edde88a1.exe
"C:\Users\Admin\AppData\Local\Temp\34cad56539e803ceb0148995edde88a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\34cad56539e803ceb0148995edde88a1.exe
  "C:\Users\Admin\AppData\Local\Temp\34cad56539e803ceb0148995edde88a1.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\chrome.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Users\Admin\AppData\Roaming\chrome.exe
        
        C:\Users\Admin\AppData\Roaming\chrome.exe
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1508
      - C:\Users\Admin\AppData\Roaming\chrome.exe
        
        C:\Users\Admin\AppData\Roaming\chrome.exe
        6⤵
        Adds Run key to start application
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-6-0x0000000002670000-0x0000000002674000-memory.dmp

Filesize
16KB

Download
memory/1552-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1552-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1788-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing