remcos | a1e66473cfdd393d62a203c1f16190106881f1fe6a671081e232f6ec1ab191fa

Analysis

max time kernel
144s
max time network
150s
platform
windows10_x64
resource
win10
submitted
28/10/2020, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order..exe
Size 240KB
Sample201028-6c6ejhr3ee
SHA256 a1e66473cfdd393d62a203c1f16190106881f1fe6a671081e232f6ec1ab191fa
MD5 407f87b0adf2f788bb357e6ca02c9244
SHA1 13189fb04bec2d3c8756002508f88c56befba45c
SHA512 e8cdf9363b8f18d4bef8066eeb419f8a3912c1a687e332b97738fa7b8e8f423eb2ea39ce2e845be999616dcc4361b72ff8ef4ddb78bd0353d60d915edf71434d
MD5 SHA1 SHA512

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

79.134.225.50:42025

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2496	tmp.exe
3552	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3932 set thread context of 3552	3932	Purchase Order..exe	78

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2160	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3932	Purchase Order..exe
3932	Purchase Order..exe
3932	Purchase Order..exe
3932	Purchase Order..exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	Purchase Order..exe
Token: 33	3932	Purchase Order..exe
Token: SeIncBasePriorityPrivilege	3932	Purchase Order..exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2496	tmp.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2496	3932	Purchase Order..exe	77
PID 3932 wrote to memory of 2496	3932	Purchase Order..exe	77
PID 3932 wrote to memory of 2496	3932	Purchase Order..exe	77
PID 3932 wrote to memory of 3552	3932	Purchase Order..exe	78
PID 3932 wrote to memory of 3552	3932	Purchase Order..exe	78
PID 3932 wrote to memory of 3552	3932	Purchase Order..exe	78
PID 3932 wrote to memory of 3552	3932	Purchase Order..exe	78
PID 3932 wrote to memory of 3552	3932	Purchase Order..exe	78
PID 3932 wrote to memory of 3552	3932	Purchase Order..exe	78
PID 3932 wrote to memory of 3552	3932	Purchase Order..exe	78
PID 3932 wrote to memory of 3552	3932	Purchase Order..exe	78
PID 3932 wrote to memory of 3552	3932	Purchase Order..exe	78
PID 3932 wrote to memory of 3744	3932	Purchase Order..exe	79
PID 3932 wrote to memory of 3744	3932	Purchase Order..exe	79
PID 3932 wrote to memory of 3744	3932	Purchase Order..exe	79
PID 3932 wrote to memory of 1012	3932	Purchase Order..exe	81
PID 3932 wrote to memory of 1012	3932	Purchase Order..exe	81
PID 3932 wrote to memory of 1012	3932	Purchase Order..exe	81
PID 1012 wrote to memory of 1928	1012	cmd.exe	83
PID 1012 wrote to memory of 1928	1012	cmd.exe	83
PID 1012 wrote to memory of 1928	1012	cmd.exe	83
PID 3932 wrote to memory of 972	3932	Purchase Order..exe	84
PID 3932 wrote to memory of 972	3932	Purchase Order..exe	84
PID 3932 wrote to memory of 972	3932	Purchase Order..exe	84
PID 3932 wrote to memory of 3788	3932	Purchase Order..exe	86
PID 3932 wrote to memory of 3788	3932	Purchase Order..exe	86
PID 3932 wrote to memory of 3788	3932	Purchase Order..exe	86
PID 3932 wrote to memory of 3044	3932	Purchase Order..exe	88
PID 3932 wrote to memory of 3044	3932	Purchase Order..exe	88
PID 3932 wrote to memory of 3044	3932	Purchase Order..exe	88
PID 3044 wrote to memory of 2160	3044	cmd.exe	90
PID 3044 wrote to memory of 2160	3044	cmd.exe	90
PID 3044 wrote to memory of 2160	3044	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Purchase Order..exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Roaming\tmp.exe
  "C:\Users\Admin\AppData\Roaming\tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2496
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Purchase Order..exe" "%appdata%\FolderN\name.exe" /Y
  2⤵
  PID:3744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\FolderN\name.exe.lnk" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk" /f
    3⤵
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\FolderN\name.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\FolderN\name.exe.jpg" name.exe
  2⤵
  PID:3788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderN\name.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3932-1-0x0000000000A30000-0x0000000000A31000-memory.dmp

Download

memory/3932-3-0x00000000056D0000-0x00000000056D1000-memory.dmp

Download

memory/3932-0-0x0000000073500000-0x0000000073BEE000-memory.dmp

Download

memory/3932-4-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download