remcos | 763d415415add2ffc6d482373e211c8c8b647ee46ade5e8dacce10f79d515e2b

Analysis

max time kernel
151s
max time network
152s
platform
windows10_x64
resource
win10v200722
submitted
07/10/2020, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2nd INVOICE FOR SMT NCPH.exe
Size 782KB
Sample201007-3jernmx32s
SHA256 763d415415add2ffc6d482373e211c8c8b647ee46ade5e8dacce10f79d515e2b
MD5 122cb8f14b324667bd5c1e5905e07a78
SHA1 0d2fb386e58a8b20b4b73bb4835ebd4a637861e9
SHA512 ad43c4064500e9f6d0a4b1d3a5ea1240de4cc99c97a699a50ebf065fa0b96375d239319c9992ce20ba4b9f86fd3e08d027dbb28019ec6b6d713c87bd67502e45
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat spyware

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos = "\"C:\\Program Files (x86)\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2nd INVOICE FOR SMT NCPH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Remcos = "\"C:\\Program Files (x86)\\Remcos\\remcos.exe\""	2nd INVOICE FOR SMT NCPH.exe

Executes dropped EXE 5 IoCs

pid	Process
740	remcos.exe
3680	remcos.exe
2168	remcos.exe
208	remcos.exe
2784	remcos.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\	2nd INVOICE FOR SMT NCPH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Program Files (x86)\\Remcos\\remcos.exe\""	2nd INVOICE FOR SMT NCPH.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	2nd INVOICE FOR SMT NCPH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Program Files (x86)\\Remcos\\remcos.exe\""	2nd INVOICE FOR SMT NCPH.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Program Files (x86)\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Program Files (x86)\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 500 set thread context of 2636	500	2nd INVOICE FOR SMT NCPH.exe	72
PID 740 set thread context of 3680	740	remcos.exe	77
PID 3680 set thread context of 2168	3680	remcos.exe	80
PID 3680 set thread context of 208	3680	remcos.exe	81
PID 3680 set thread context of 2784	3680	remcos.exe	82

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remcos\remcos.exe	2nd INVOICE FOR SMT NCPH.exe
File opened for modification	C:\Program Files (x86)\Remcos\remcos.exe	2nd INVOICE FOR SMT NCPH.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	2nd INVOICE FOR SMT NCPH.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
500	2nd INVOICE FOR SMT NCPH.exe
500	2nd INVOICE FOR SMT NCPH.exe
2636	2nd INVOICE FOR SMT NCPH.exe
2636	2nd INVOICE FOR SMT NCPH.exe
2636	2nd INVOICE FOR SMT NCPH.exe
2636	2nd INVOICE FOR SMT NCPH.exe
740	remcos.exe
740	remcos.exe
3680	remcos.exe
3680	remcos.exe
3680	remcos.exe
3680	remcos.exe
2168	remcos.exe
2168	remcos.exe
208	remcos.exe
208	remcos.exe
2168	remcos.exe
2168	remcos.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3680	remcos.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
500	2nd INVOICE FOR SMT NCPH.exe
740	remcos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	208	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3680	remcos.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 2636	500	2nd INVOICE FOR SMT NCPH.exe	72
PID 500 wrote to memory of 2636	500	2nd INVOICE FOR SMT NCPH.exe	72
PID 500 wrote to memory of 2636	500	2nd INVOICE FOR SMT NCPH.exe	72
PID 2636 wrote to memory of 3972	2636	2nd INVOICE FOR SMT NCPH.exe	73
PID 2636 wrote to memory of 3972	2636	2nd INVOICE FOR SMT NCPH.exe	73
PID 2636 wrote to memory of 3972	2636	2nd INVOICE FOR SMT NCPH.exe	73
PID 3972 wrote to memory of 4040	3972	WScript.exe	74
PID 3972 wrote to memory of 4040	3972	WScript.exe	74
PID 3972 wrote to memory of 4040	3972	WScript.exe	74
PID 4040 wrote to memory of 740	4040	cmd.exe	76
PID 4040 wrote to memory of 740	4040	cmd.exe	76
PID 4040 wrote to memory of 740	4040	cmd.exe	76
PID 740 wrote to memory of 3680	740	remcos.exe	77
PID 740 wrote to memory of 3680	740	remcos.exe	77
PID 740 wrote to memory of 3680	740	remcos.exe	77
PID 3680 wrote to memory of 2168	3680	remcos.exe	80
PID 3680 wrote to memory of 2168	3680	remcos.exe	80
PID 3680 wrote to memory of 2168	3680	remcos.exe	80
PID 3680 wrote to memory of 2168	3680	remcos.exe	80
PID 3680 wrote to memory of 2168	3680	remcos.exe	80
PID 3680 wrote to memory of 2168	3680	remcos.exe	80
PID 3680 wrote to memory of 2168	3680	remcos.exe	80
PID 3680 wrote to memory of 2168	3680	remcos.exe	80
PID 3680 wrote to memory of 208	3680	remcos.exe	81
PID 3680 wrote to memory of 208	3680	remcos.exe	81
PID 3680 wrote to memory of 208	3680	remcos.exe	81
PID 3680 wrote to memory of 208	3680	remcos.exe	81
PID 3680 wrote to memory of 208	3680	remcos.exe	81
PID 3680 wrote to memory of 208	3680	remcos.exe	81
PID 3680 wrote to memory of 208	3680	remcos.exe	81
PID 3680 wrote to memory of 208	3680	remcos.exe	81
PID 3680 wrote to memory of 2784	3680	remcos.exe	82
PID 3680 wrote to memory of 2784	3680	remcos.exe	82
PID 3680 wrote to memory of 2784	3680	remcos.exe	82
PID 3680 wrote to memory of 2784	3680	remcos.exe	82
PID 3680 wrote to memory of 2784	3680	remcos.exe	82
PID 3680 wrote to memory of 2784	3680	remcos.exe	82
PID 3680 wrote to memory of 2784	3680	remcos.exe	82
PID 3680 wrote to memory of 2784	3680	remcos.exe	82

C:\Users\Admin\AppData\Local\Temp\2nd INVOICE FOR SMT NCPH.exe
"C:\Users\Admin\AppData\Local\Temp\2nd INVOICE FOR SMT NCPH.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\AppData\Local\Temp\2nd INVOICE FOR SMT NCPH.exe
  "C:\Users\Admin\AppData\Local\Temp\2nd INVOICE FOR SMT NCPH.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4040
    - - C:\Program Files (x86)\Remcos\remcos.exe
        
        "C:\Program Files (x86)\Remcos\remcos.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:740
      - C:\Program Files (x86)\Remcos\remcos.exe
        
        "C:\Program Files (x86)\Remcos\remcos.exe"
        6⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Program Files (x86)\Remcos\remcos.exe
        
        "C:\Program Files (x86)\Remcos\remcos.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lsnqpoggows"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2168
        
        C:\Program Files (x86)\Remcos\remcos.exe
        
        "C:\Program Files (x86)\Remcos\remcos.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wubjqhricektuy"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:208
        
        C:\Program Files (x86)\Remcos\remcos.exe
        
        "C:\Program Files (x86)\Remcos\remcos.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gogbrzcbymcywmfrew"
        7⤵
        Executes dropped EXE
        
        PID:2784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-20-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/208-28-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/208-26-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/500-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/740-11-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/2168-21-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2168-17-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2168-23-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2636-4-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2636-3-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2636-1-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2784-25-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2784-30-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2784-31-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3680-16-0x0000000000400000-0x0000000000577000-memory.dmp

Download