remcos

General

Target
6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc
Size 519KB
Sample201103-rpcq9dk83j
SHA256 6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc
MD5 a529633ffa991638887d99c4cbfa9eb4
SHA1 e119a6cbb6ff426ca35ef597a5906231dbd34b64
SHA512 bd73e3df113262f10693fe321873b6d6af6ad9f4401d739cec1dde855e47b8858b362c251b191bb3c542cdb307f35c0afdc80a47cecb604c4ccc5545e7965956
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

C2

moorenike.sytes.net:1024

Targets

- Target
  6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc
- Size 519KB
- SHA256 6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc
- MD5 a529633ffa991638887d99c4cbfa9eb4
- SHA1 e119a6cbb6ff426ca35ef597a5906231dbd34b64
- SHA512 bd73e3df113262f10693fe321873b6d6af6ad9f4401d739cec1dde855e47b8858b362c251b191bb3c542cdb307f35c0afdc80a47cecb604c4ccc5545e7965956
- MD5 SHA1 SHA512
Score

10^/10

remcos persistence rat
- Modifies WinLogon for persistence
  persistence
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Modifies WinLogon for persistence

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2