remcos | f412da03defe68cc6e1f264449adf519a4c5470c51e7b502854f7fbf358f8516

General

Target

34cad56539e803ceb0148995edde88a1.exe
Size

646KB
MD5

34cad56539e803ceb0148995edde88a1
SHA1

5b3b216e3ab8b5223534e5dc7e545604740d9951
SHA256

f412da03defe68cc6e1f264449adf519a4c5470c51e7b502854f7fbf358f8516
SHA512

4a3c6c7de06af36d2fef785f2af170b5edafdab5963e9d520f58c5e5a119fc65e683347c831b3664b71bcf3b84099028ada3c492057214711dda60e861558dda

Score

10^/10

persistence rat remcos

Malware Config

Extracted

Family

remcos

C2

185.140.53.209:1990

Signatures

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 3896	3684	34cad56539e803ceb0148995edde88a1.exe	67
PID 3684 wrote to memory of 3896	3684	34cad56539e803ceb0148995edde88a1.exe	67
PID 3684 wrote to memory of 3896	3684	34cad56539e803ceb0148995edde88a1.exe	67
PID 3896 wrote to memory of 3864	3896	34cad56539e803ceb0148995edde88a1.exe	68
PID 3896 wrote to memory of 3864	3896	34cad56539e803ceb0148995edde88a1.exe	68
PID 3896 wrote to memory of 3864	3896	34cad56539e803ceb0148995edde88a1.exe	68
PID 3864 wrote to memory of 3928	3864	WScript.exe	69
PID 3864 wrote to memory of 3928	3864	WScript.exe	69
PID 3864 wrote to memory of 3928	3864	WScript.exe	69
PID 3928 wrote to memory of 3448	3928	cmd.exe	71
PID 3928 wrote to memory of 3448	3928	cmd.exe	71
PID 3928 wrote to memory of 3448	3928	cmd.exe	71
PID 3448 wrote to memory of 3460	3448	chrome.exe	72
PID 3448 wrote to memory of 3460	3448	chrome.exe	72
PID 3448 wrote to memory of 3460	3448	chrome.exe	72

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3684	34cad56539e803ceb0148995edde88a1.exe
3448	chrome.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3684 set thread context of 3896	3684	34cad56539e803ceb0148995edde88a1.exe	67
PID 3448 set thread context of 3460	3448	chrome.exe	72

Executes dropped EXE 2 IoCs

pid	Process
3448	chrome.exe
3460	chrome.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\localhost = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrome.exe\""	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\	34cad56539e803ceb0148995edde88a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\localhost = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrome.exe\""	34cad56539e803ceb0148995edde88a1.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3684	34cad56539e803ceb0148995edde88a1.exe
3684	34cad56539e803ceb0148995edde88a1.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3460	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3460	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	34cad56539e803ceb0148995edde88a1.exe

C:\Users\Admin\AppData\Local\Temp\34cad56539e803ceb0148995edde88a1.exe
"C:\Users\Admin\AppData\Local\Temp\34cad56539e803ceb0148995edde88a1.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3684
- C:\Users\Admin\AppData\Local\Temp\34cad56539e803ceb0148995edde88a1.exe
  "C:\Users\Admin\AppData\Local\Temp\34cad56539e803ceb0148995edde88a1.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Adds Run key to start application
  - Modifies registry class
  PID:3896
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\chrome.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3928
    - - C:\Users\Admin\AppData\Roaming\chrome.exe
        
        C:\Users\Admin\AppData\Roaming\chrome.exe
        5⤵
        Suspicious use of WriteProcessMemory
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3448
      - C:\Users\Admin\AppData\Roaming\chrome.exe
        
        C:\Users\Admin\AppData\Roaming\chrome.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:3460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3460-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3896-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3896-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing