remcos

General

Target
New order for 1x40ft container.exe
Size 769KB
Sample201015-29grvetpcn
SHA256 74ac8fc2b4b1a8d3a9aa59496ea6fcd5669e26ed51fec6c3a62a9a68bea89343
MD5 4c95b4e3635b639f4c9293e22e9a6c7c
SHA1 70fa15d267a9c4a563796df4aeef1a8bfec0e011
SHA512 8d85766f09f85e12b455aa58ac0ecd1be8e7907d6967224e939bd6976c90d8e07f033902f95ddebc48d7c27843b04b340d78b5a2e19037146540f742f7cc73ec
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

C2

79.134.225.80:1952

Targets

- Target
  New order for 1x40ft container.exe
- Size 769KB
- SHA256 74ac8fc2b4b1a8d3a9aa59496ea6fcd5669e26ed51fec6c3a62a9a68bea89343
- MD5 4c95b4e3635b639f4c9293e22e9a6c7c
- SHA1 70fa15d267a9c4a563796df4aeef1a8bfec0e011
- SHA512 8d85766f09f85e12b455aa58ac0ecd1be8e7907d6967224e939bd6976c90d8e07f033902f95ddebc48d7c27843b04b340d78b5a2e19037146540f742f7cc73ec
- MD5 SHA1 SHA512
Score

10^/10

persistence rat remcos
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- ServiceHost packer
  Detects ServiceHost packer used for .NET malware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

ServiceHost packer

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2