remcos | 4096056536154e1fa5a10e3495cd3ddadf7c01022b7b65b0c35a67b2eac2bc6b

General

Target
1cb0921524b39fdcbe3e78e825abe9a4.exe
Size 646KB
Sample200716-l2evfmzq1x
SHA256 4096056536154e1fa5a10e3495cd3ddadf7c01022b7b65b0c35a67b2eac2bc6b
MD5 1cb0921524b39fdcbe3e78e825abe9a4
SHA1 d75f9ec2d4fa06b289ecd2741c6bff27974b3566
SHA512 20f616acb33fe44f5eeba1ad5f70d9e6a0dcd7f44dfc4f6d8c11fb8be5a954b64984f0bb4431b880f2f223754369bd3e6e94b22060f920d9024ae2eb287fb50a
MD5 SHA1 SHA512

Score

10^/10

rat remcos persistence

Malware Config

Extracted

Family

remcos

C2

185.140.53.209:1990

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3152	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3152	chrome.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\	1cb0921524b39fdcbe3e78e825abe9a4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\localhost = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrome.exe\""	1cb0921524b39fdcbe3e78e825abe9a4.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\localhost = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrome.exe\""	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	1cb0921524b39fdcbe3e78e825abe9a4.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4016	3900	1cb0921524b39fdcbe3e78e825abe9a4.exe	67
PID 3900 wrote to memory of 4016	3900	1cb0921524b39fdcbe3e78e825abe9a4.exe	67
PID 3900 wrote to memory of 4016	3900	1cb0921524b39fdcbe3e78e825abe9a4.exe	67
PID 4016 wrote to memory of 776	4016	1cb0921524b39fdcbe3e78e825abe9a4.exe	68
PID 4016 wrote to memory of 776	4016	1cb0921524b39fdcbe3e78e825abe9a4.exe	68
PID 4016 wrote to memory of 776	4016	1cb0921524b39fdcbe3e78e825abe9a4.exe	68
PID 776 wrote to memory of 3936	776	WScript.exe	69
PID 776 wrote to memory of 3936	776	WScript.exe	69
PID 776 wrote to memory of 3936	776	WScript.exe	69
PID 3936 wrote to memory of 3104	3936	cmd.exe	71
PID 3936 wrote to memory of 3104	3936	cmd.exe	71
PID 3936 wrote to memory of 3104	3936	cmd.exe	71
PID 3104 wrote to memory of 3152	3104	chrome.exe	72
PID 3104 wrote to memory of 3152	3104	chrome.exe	72
PID 3104 wrote to memory of 3152	3104	chrome.exe	72

Executes dropped EXE 2 IoCs

pid	Process
3104	chrome.exe
3152	chrome.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3900 set thread context of 4016	3900	1cb0921524b39fdcbe3e78e825abe9a4.exe	67
PID 3104 set thread context of 3152	3104	chrome.exe	72

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3900	1cb0921524b39fdcbe3e78e825abe9a4.exe
3900	1cb0921524b39fdcbe3e78e825abe9a4.exe
3104	chrome.exe
3104	chrome.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3900	1cb0921524b39fdcbe3e78e825abe9a4.exe
3104	chrome.exe

C:\Users\Admin\AppData\Local\Temp\1cb0921524b39fdcbe3e78e825abe9a4.exe
"C:\Users\Admin\AppData\Local\Temp\1cb0921524b39fdcbe3e78e825abe9a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3900
- C:\Users\Admin\AppData\Local\Temp\1cb0921524b39fdcbe3e78e825abe9a4.exe
  "C:\Users\Admin\AppData\Local\Temp\1cb0921524b39fdcbe3e78e825abe9a4.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:776
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\chrome.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\Users\Admin\AppData\Roaming\chrome.exe
        
        C:\Users\Admin\AppData\Roaming\chrome.exe
        5⤵
        Suspicious use of WriteProcessMemory
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3104
      - C:\Users\Admin\AppData\Roaming\chrome.exe
        
        C:\Users\Admin\AppData\Roaming\chrome.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: GetForegroundWindowSpam
        Adds Run key to start application
        Executes dropped EXE
        
        PID:3152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3152-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4016-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4016-2-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads