remcos | 485c1301f4bc84bc2d274f53222cf7ca5fbd8af8728d1aaa977a6574f577fb87

General

Target
Payment_Swift.exe
Size 289KB
Sample200831-g25wlx2dyn
SHA256 485c1301f4bc84bc2d274f53222cf7ca5fbd8af8728d1aaa977a6574f577fb87
MD5 f9bfbd329b700b7fcec0cdf438b2698a
SHA1 ac73792877fb0c43917ed9bf04c9f49351e6cb79
SHA512 9c7abd6b1e9ade77ef55e7099e85cb6f33e85066a2405dd242b570b0288dc53a896833da3a1d9cce97162434aa3c5df5e1f0df055da4fe55ab9b4aeadea774f6
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

91.193.75.146:2021
185.165.153.151:2244

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000\Software\Microsoft\Windows\CurrentVersion\Run\Monday31 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Monday31.exe\""	Payment_Swift.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 636	916	Payment_Swift.exe	76

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 29d1ab6a977fd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe
916	Payment_Swift.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3016	svchost.exe
Token: SeCreatePagefilePrivilege	3016	svchost.exe
Token: SeDebugPrivilege	916	Payment_Swift.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
636	Payment_Swift.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3764	916	Payment_Swift.exe	75
PID 916 wrote to memory of 3764	916	Payment_Swift.exe	75
PID 916 wrote to memory of 3764	916	Payment_Swift.exe	75
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76
PID 916 wrote to memory of 636	916	Payment_Swift.exe	76

C:\Users\Admin\AppData\Local\Temp\Payment_Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_Swift.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\Payment_Swift.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment_Swift.exe"
  2⤵
  PID:3764
- C:\Users\Admin\AppData\Local\Temp\Payment_Swift.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment_Swift.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-9-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/636-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/916-0-0x00000000737B0000-0x0000000073E9E000-memory.dmp

Download

memory/916-1-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/916-3-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/916-4-0x00000000053D0000-0x00000000053D1000-memory.dmp

Download

memory/916-5-0x0000000005350000-0x0000000005351000-memory.dmp

Download

memory/916-6-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/916-7-0x0000000005540000-0x000000000557A000-memory.dmp

Download

memory/916-8-0x0000000005D30000-0x0000000005D31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads