remcos | c032e316eefbacca4b3ddfe7fc2ee9ac5f86daea767232d2322f7fdfe4b18993

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7v200722
submitted
19/10/2020, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Returned Payment.exe
Size 731KB
Sample201019-wbpbeb3lfx
SHA256 c032e316eefbacca4b3ddfe7fc2ee9ac5f86daea767232d2322f7fdfe4b18993
MD5 200ce22a59487610754d7c842e1c52f6
SHA1 aefe3c37d312a7873425a632d4532750f307c8c9
SHA512 1e031c091bacd23b26570e33d16580605a2db8d28aeb8280fde151cc5af5499c44983b1bf9303765106646177428e4cb4eda215b7105989cde7c7d21c79e6e76
MD5 SHA1 SHA512

Score

10^/10

rat remcos spyware

Malware Config

Extracted

Family

remcos

185.140.53.192:1011

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1436 set thread context of 1944	1436	Returned Payment.exe	30
PID 1944 set thread context of 1984	1944	vbc.exe	31
PID 1944 set thread context of 1964	1944	vbc.exe	32
PID 1944 set thread context of 1764	1944	vbc.exe	33

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1984	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1944	vbc.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1724	1436	Returned Payment.exe	28
PID 1436 wrote to memory of 1724	1436	Returned Payment.exe	28
PID 1436 wrote to memory of 1724	1436	Returned Payment.exe	28
PID 1436 wrote to memory of 1724	1436	Returned Payment.exe	28
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1436 wrote to memory of 1944	1436	Returned Payment.exe	30
PID 1944 wrote to memory of 1984	1944	vbc.exe	31
PID 1944 wrote to memory of 1984	1944	vbc.exe	31
PID 1944 wrote to memory of 1984	1944	vbc.exe	31
PID 1944 wrote to memory of 1984	1944	vbc.exe	31
PID 1944 wrote to memory of 1984	1944	vbc.exe	31
PID 1944 wrote to memory of 1984	1944	vbc.exe	31
PID 1944 wrote to memory of 1984	1944	vbc.exe	31
PID 1944 wrote to memory of 1984	1944	vbc.exe	31
PID 1944 wrote to memory of 1984	1944	vbc.exe	31
PID 1944 wrote to memory of 1964	1944	vbc.exe	32
PID 1944 wrote to memory of 1964	1944	vbc.exe	32
PID 1944 wrote to memory of 1964	1944	vbc.exe	32
PID 1944 wrote to memory of 1964	1944	vbc.exe	32
PID 1944 wrote to memory of 1964	1944	vbc.exe	32
PID 1944 wrote to memory of 1964	1944	vbc.exe	32
PID 1944 wrote to memory of 1964	1944	vbc.exe	32
PID 1944 wrote to memory of 1964	1944	vbc.exe	32
PID 1944 wrote to memory of 1964	1944	vbc.exe	32
PID 1944 wrote to memory of 1764	1944	vbc.exe	33
PID 1944 wrote to memory of 1764	1944	vbc.exe	33
PID 1944 wrote to memory of 1764	1944	vbc.exe	33
PID 1944 wrote to memory of 1764	1944	vbc.exe	33
PID 1944 wrote to memory of 1764	1944	vbc.exe	33
PID 1944 wrote to memory of 1764	1944	vbc.exe	33
PID 1944 wrote to memory of 1764	1944	vbc.exe	33
PID 1944 wrote to memory of 1764	1944	vbc.exe	33
PID 1944 wrote to memory of 1764	1944	vbc.exe	33

C:\Users\Admin\AppData\Local\Temp\Returned Payment.exe
"C:\Users\Admin\AppData\Local\Temp\Returned Payment.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UfvpzAIsPXWii" /XML "C:\Users\Admin\AppData\Local\Temp\tmp95CA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\unkm"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1984
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\ehqxbja"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\hjvqcbtcyc"
    3⤵
    PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1436-4-0x00000000021E0000-0x0000000002232000-memory.dmp

Download

memory/1436-3-0x0000000000670000-0x000000000067B000-memory.dmp

Download

memory/1436-0-0x0000000074820000-0x0000000074F0E000-memory.dmp

Download

memory/1436-5-0x0000000002080000-0x00000000020A3000-memory.dmp

Download

memory/1436-1-0x0000000000970000-0x0000000000971000-memory.dmp

Download

memory/1764-22-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1764-21-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1764-17-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1944-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1944-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1964-16-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1964-18-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1964-13-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1984-15-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1984-20-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1984-11-0x0000000000400000-0x0000000000478000-memory.dmp

Download