remcos | 246fb765947ed62ef616f5f714642ff0db639983582c0fa2cbab9ad251669b78

General

Target

FDA_certs.exe
Size

371KB
MD5

9c547767c3059a4aa991b4b4413725bb
SHA1

fd83c2cf73a959255d01abca9d681af4c62d5dbf
SHA256

246fb765947ed62ef616f5f714642ff0db639983582c0fa2cbab9ad251669b78
SHA512

1a3e2250804bc524750cdf3517b51af04e6988bc080a2d35468fc2e16758b6cd8970ff416ce0a009cbda387b31aaa0e698e8e5d1aba3f60c6110e069e4c1b1b7

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

kmt.duckdns.org:3039

kmt-2.duckdns.org:3039

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

FDA_certs.exe

description pid process target process

PID 2036 set thread context of 1972 2036 FDA_certs.exe MSBuild.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1928 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

FDA_certs.exe

pid process

2036 FDA_certs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FDA_certs.exe

description pid process

Token: SeDebugPrivilege 2036 FDA_certs.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

FDA_certs.exe

pid process

2036 FDA_certs.exe
2036 FDA_certs.exe

description	pid	process	target process
PID 2036 set thread context of 1972	2036	FDA_certs.exe	MSBuild.exe

pid	process
1928	schtasks.exe

pid	process
2036	FDA_certs.exe

description	pid	process
Token: SeDebugPrivilege	2036	FDA_certs.exe

pid	process
2036	FDA_certs.exe
2036	FDA_certs.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

FDA_certs.exe

description	pid	process	target process
PID 2036 wrote to memory of 1928	2036	FDA_certs.exe	schtasks.exe
PID 2036 wrote to memory of 1928	2036	FDA_certs.exe	schtasks.exe
PID 2036 wrote to memory of 1928	2036	FDA_certs.exe	schtasks.exe
PID 2036 wrote to memory of 1928	2036	FDA_certs.exe	schtasks.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe
PID 2036 wrote to memory of 1972	2036	FDA_certs.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\FDA_certs.exe
"C:\Users\Admin\AppData\Local\Temp\FDA_certs.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HXAjzs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp21D3.tmp"
2⤵
- Creates scheduled task(s)
PID:1928

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
2⤵
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp21D3.tmp
MD5
3e1859204b8ba4c248e4703e4b9c2b66

SHA1
d9d3ee93064dfce080010bc3bfe20708061a8acc

SHA256
a54cdba41a97a1495eb87e2ba0179bddea6003f6f400588c07391e091f55255f

SHA512
36b0a6953ce754f4bd82735a68e0f6b43063b9ef14d242ce5fa4c829c1b516b1b10e185df2eb1231c294bbc1e4176a4afe8f9aa8e3d70200c440466e9e1c63fc

Download Submit
memory/1760-115-0x000007FEF6B90000-0x000007FEF6E0A000-memory.dmp

Filesize
2.5MB

Download
memory/1928-116-0x0000000000000000-mapping.dmp

Download
memory/1972-118-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1972-119-0x000000000040FD88-mapping.dmp

Download
memory/1972-120-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads