remcos | c032e316eefbacca4b3ddfe7fc2ee9ac5f86daea767232d2322f7fdfe4b18993

Analysis

max time kernel
149s
max time network
152s
platform
windows10_x64
resource
win10
submitted
19/10/2020, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Returned Payment.exe
Size 731KB
Sample201019-wbpbeb3lfx
SHA256 c032e316eefbacca4b3ddfe7fc2ee9ac5f86daea767232d2322f7fdfe4b18993
MD5 200ce22a59487610754d7c842e1c52f6
SHA1 aefe3c37d312a7873425a632d4532750f307c8c9
SHA512 1e031c091bacd23b26570e33d16580605a2db8d28aeb8280fde151cc5af5499c44983b1bf9303765106646177428e4cb4eda215b7105989cde7c7d21c79e6e76
MD5 SHA1 SHA512

Score

10^/10

spyware rat remcos

Malware Config

Extracted

Family

remcos

185.140.53.192:1011

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3588 set thread context of 2172	3588	Returned Payment.exe	78
PID 2172 set thread context of 3388	2172	vbc.exe	79
PID 2172 set thread context of 3636	2172	vbc.exe	81

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3388	vbc.exe
3388	vbc.exe
3388	vbc.exe
3388	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	vbc.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 1788	3588	Returned Payment.exe	76
PID 3588 wrote to memory of 1788	3588	Returned Payment.exe	76
PID 3588 wrote to memory of 1788	3588	Returned Payment.exe	76
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 3588 wrote to memory of 2172	3588	Returned Payment.exe	78
PID 2172 wrote to memory of 3388	2172	vbc.exe	79
PID 2172 wrote to memory of 3388	2172	vbc.exe	79
PID 2172 wrote to memory of 3388	2172	vbc.exe	79
PID 2172 wrote to memory of 3388	2172	vbc.exe	79
PID 2172 wrote to memory of 3388	2172	vbc.exe	79
PID 2172 wrote to memory of 3388	2172	vbc.exe	79
PID 2172 wrote to memory of 3388	2172	vbc.exe	79
PID 2172 wrote to memory of 3388	2172	vbc.exe	79
PID 2172 wrote to memory of 3728	2172	vbc.exe	80
PID 2172 wrote to memory of 3728	2172	vbc.exe	80
PID 2172 wrote to memory of 3728	2172	vbc.exe	80
PID 2172 wrote to memory of 3636	2172	vbc.exe	81
PID 2172 wrote to memory of 3636	2172	vbc.exe	81
PID 2172 wrote to memory of 3636	2172	vbc.exe	81
PID 2172 wrote to memory of 3636	2172	vbc.exe	81
PID 2172 wrote to memory of 3636	2172	vbc.exe	81
PID 2172 wrote to memory of 3636	2172	vbc.exe	81
PID 2172 wrote to memory of 3636	2172	vbc.exe	81
PID 2172 wrote to memory of 3636	2172	vbc.exe	81

C:\Users\Admin\AppData\Local\Temp\Returned Payment.exe
"C:\Users\Admin\AppData\Local\Temp\Returned Payment.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UfvpzAIsPXWii" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE69D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\rmslgnhzrgvrwuorysgojvqeqz"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3388
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\uofdgfstfoneyikvictquakvrgxva"
    3⤵
    PID:3728
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\eilohydvtwfjjoyhznorxnxezmpetkwzk"
    3⤵
    PID:3636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-15-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2172-13-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3388-19-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3388-16-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3388-22-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3588-6-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/3588-9-0x00000000058C0000-0x0000000005912000-memory.dmp

Download

memory/3588-5-0x0000000004C40000-0x0000000004C41000-memory.dmp

Download

memory/3588-4-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/3588-3-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Download

memory/3588-7-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Download

memory/3588-10-0x0000000005A30000-0x0000000005A53000-memory.dmp

Download

memory/3588-8-0x0000000004B70000-0x0000000004B7B000-memory.dmp

Download

memory/3588-0-0x0000000073A30000-0x000000007411E000-memory.dmp

Download

memory/3588-1-0x0000000000280000-0x0000000000281000-memory.dmp

Download

memory/3636-18-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3636-21-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3636-23-0x0000000000400000-0x0000000000457000-memory.dmp

Download