remcos | 9c76803cb5acd81ad611eed2bc4daa50f1a4e27cd2cea75e40f0d5011047e2a9

Analysis

max time kernel
148s
max time network
145s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.scr
Size 629KB
Sample201109-bj38kmvf92
SHA256 9c76803cb5acd81ad611eed2bc4daa50f1a4e27cd2cea75e40f0d5011047e2a9
MD5 6c7b002d23f38600926eba53eb0126cf
SHA1 9c87e9ec996b656ffd828df91458645459559565
SHA512 f469eea958a41abf4034858aff6232f0265301be6a4384b0d5665bc87a9d303a491bc2e07c99d11f0ba1302eaee87e4f50659a0a6662988a639024652e494371
MD5 SHA1 SHA512

Score

10^/10

remcos evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

188.72.124.143:2858

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 2 IoCs

pid	Process
2688	xls.exe
3236	xls.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\xls = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\xls.exe\""	file.scr
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	xls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\xls = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\xls.exe\""	xls.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	file.scr

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 4020	1036	file.scr	74
PID 2688 set thread context of 3236	2688	xls.exe	84

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	file.scr

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3344	reg.exe
1352	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1036	file.scr
1036	file.scr
2688	xls.exe
2688	xls.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1036	file.scr
2688	xls.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4020	1036	file.scr	74
PID 1036 wrote to memory of 4020	1036	file.scr	74
PID 1036 wrote to memory of 4020	1036	file.scr	74
PID 4020 wrote to memory of 3660	4020	file.scr	75
PID 4020 wrote to memory of 3660	4020	file.scr	75
PID 4020 wrote to memory of 3660	4020	file.scr	75
PID 3660 wrote to memory of 3344	3660	cmd.exe	77
PID 3660 wrote to memory of 3344	3660	cmd.exe	77
PID 3660 wrote to memory of 3344	3660	cmd.exe	77
PID 4020 wrote to memory of 3936	4020	file.scr	79
PID 4020 wrote to memory of 3936	4020	file.scr	79
PID 4020 wrote to memory of 3936	4020	file.scr	79
PID 3936 wrote to memory of 1316	3936	WScript.exe	81
PID 3936 wrote to memory of 1316	3936	WScript.exe	81
PID 3936 wrote to memory of 1316	3936	WScript.exe	81
PID 1316 wrote to memory of 2688	1316	cmd.exe	83
PID 1316 wrote to memory of 2688	1316	cmd.exe	83
PID 1316 wrote to memory of 2688	1316	cmd.exe	83
PID 2688 wrote to memory of 3236	2688	xls.exe	84
PID 2688 wrote to memory of 3236	2688	xls.exe	84
PID 2688 wrote to memory of 3236	2688	xls.exe	84
PID 3236 wrote to memory of 3408	3236	xls.exe	85
PID 3236 wrote to memory of 3408	3236	xls.exe	85
PID 3236 wrote to memory of 3408	3236	xls.exe	85
PID 3236 wrote to memory of 1364	3236	xls.exe	87
PID 3236 wrote to memory of 1364	3236	xls.exe	87
PID 3236 wrote to memory of 1364	3236	xls.exe	87
PID 3408 wrote to memory of 1352	3408	cmd.exe	88
PID 3408 wrote to memory of 1352	3408	cmd.exe	88
PID 3408 wrote to memory of 1352	3408	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\file.scr
"C:\Users\Admin\AppData\Local\Temp\file.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\file.scr
  "C:\Users\Admin\AppData\Local\Temp\file.scr" /S
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:3344
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\xls.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Users\Admin\AppData\Roaming\remcos\xls.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\xls.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2688
      - C:\Users\Admin\AppData\Roaming\remcos\xls.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\xls.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        Modifies registry key
        
        PID:1352
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:1364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3236-14-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4020-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4020-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download