remcos | f89c8debd5a5759bd372622cf7be54424d5e87c8b8246fb44835ea94d1f72bad

Analysis

max time kernel
149s
max time network
146s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe
Size 557KB
Sample201109-c5hg2cppdx
SHA256 f89c8debd5a5759bd372622cf7be54424d5e87c8b8246fb44835ea94d1f72bad
MD5 083b4694e7cb69c8109f8c1dfc8718d6
SHA1 3ad6d198f9b875973dc753231d2aff040943f244
SHA512 0b1da468a0facc8eed8aad26bc71c85aeecc8202e7da0bd802f9816f7632749dd26b78e76ae52858949aea78c4992b03be04c4eaaff34e21d8565c9140f6ceae
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

194.5.97.48:2404

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ServiceHost packer 12 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/1584-23-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/1584-22-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/1584-24-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/4480-49-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/4480-50-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/4480-51-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/2412-63-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/2412-64-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/2412-65-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/4716-77-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/4716-78-0x0000000000413A84-mapping.dmp	servicehost
behavioral2/memory/4716-79-0x0000000000413A84-mapping.dmp	servicehost

Executes dropped EXE 2 IoCs

pid	Process
428	remcos.exe
1112	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe

Suspicious use of SetThreadContext 27 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 4184	4768	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe	78
PID 428 set thread context of 1112	428	remcos.exe	83
PID 1112 set thread context of 1376	1112	remcos.exe	84
PID 1376 set thread context of 1584	1376	svchost.exe	85
PID 1112 set thread context of 1728	1112	remcos.exe	86
PID 1728 set thread context of 4480	1728	svchost.exe	89
PID 1112 set thread context of 4596	1112	remcos.exe	90
PID 4596 set thread context of 2412	4596	svchost.exe	92
PID 1112 set thread context of 2728	1112	remcos.exe	93
PID 2728 set thread context of 4716	2728	svchost.exe	95
PID 1112 set thread context of 204	1112	remcos.exe	97
PID 204 set thread context of 3660	204	svchost.exe	100
PID 1112 set thread context of 2436	1112	remcos.exe	102
PID 2436 set thread context of 1528	2436	svchost.exe	103
PID 1112 set thread context of 936	1112	remcos.exe	106
PID 936 set thread context of 5000	936	svchost.exe	108
PID 1112 set thread context of 3960	1112	remcos.exe	110
PID 3960 set thread context of 3488	3960	svchost.exe	111
PID 1112 set thread context of 3052	1112	remcos.exe	112
PID 3052 set thread context of 788	3052	svchost.exe	113
PID 1112 set thread context of 4252	1112	remcos.exe	114
PID 4252 set thread context of 4068	4252	svchost.exe	115
PID 1112 set thread context of 3824	1112	remcos.exe	116
PID 3824 set thread context of 3320	3824	svchost.exe	118
PID 1112 set thread context of 3840	1112	remcos.exe	120
PID 3840 set thread context of 5044	3840	svchost.exe	121
PID 1112 set thread context of 2092	1112	remcos.exe	122

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4060	1584	WerFault.exe	85
4580	4480	WerFault.exe	89
2980	2412	WerFault.exe	92
188	4716	WerFault.exe	95

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe

Suspicious behavior: EnumeratesProcesses 88 IoCs

pid	Process
4768	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe
4768	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe
428	remcos.exe
428	remcos.exe
1376	svchost.exe
1376	svchost.exe
1728	svchost.exe
1728	svchost.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4596	svchost.exe
4596	svchost.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
4580	WerFault.exe
2728	svchost.exe
2728	svchost.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
188	WerFault.exe
188	WerFault.exe
204	svchost.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
204	svchost.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
2436	svchost.exe
2436	svchost.exe
936	svchost.exe
936	svchost.exe
3960	svchost.exe
3960	svchost.exe
3052	svchost.exe
3052	svchost.exe
4252	svchost.exe
4252	svchost.exe
3824	svchost.exe
3824	svchost.exe
3840	svchost.exe
3840	svchost.exe
2092	svchost.exe
2092	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1112	remcos.exe

Suspicious behavior: MapViewOfSection 17 IoCs

pid	Process
4768	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe
428	remcos.exe
1376	svchost.exe
1728	svchost.exe
4596	svchost.exe
2728	svchost.exe
204	svchost.exe
204	svchost.exe
2436	svchost.exe
936	svchost.exe
936	svchost.exe
3960	svchost.exe
3052	svchost.exe
4252	svchost.exe
3824	svchost.exe
3824	svchost.exe
3840	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4060	WerFault.exe
Token: SeBackupPrivilege	4060	WerFault.exe
Token: SeDebugPrivilege	4060	WerFault.exe
Token: SeDebugPrivilege	4580	WerFault.exe
Token: SeDebugPrivilege	2980	WerFault.exe
Token: SeDebugPrivilege	188	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1112	remcos.exe

Suspicious use of WriteProcessMemory 247 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4184	4768	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe	78
PID 4768 wrote to memory of 4184	4768	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe	78
PID 4768 wrote to memory of 4184	4768	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe	78
PID 4184 wrote to memory of 4328	4184	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe	79
PID 4184 wrote to memory of 4328	4184	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe	79
PID 4184 wrote to memory of 4328	4184	PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe	79
PID 4328 wrote to memory of 644	4328	WScript.exe	80
PID 4328 wrote to memory of 644	4328	WScript.exe	80
PID 4328 wrote to memory of 644	4328	WScript.exe	80
PID 644 wrote to memory of 428	644	cmd.exe	82
PID 644 wrote to memory of 428	644	cmd.exe	82
PID 644 wrote to memory of 428	644	cmd.exe	82
PID 428 wrote to memory of 1112	428	remcos.exe	83
PID 428 wrote to memory of 1112	428	remcos.exe	83
PID 428 wrote to memory of 1112	428	remcos.exe	83
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1112 wrote to memory of 1376	1112	remcos.exe	84
PID 1376 wrote to memory of 1584	1376	svchost.exe	85
PID 1376 wrote to memory of 1584	1376	svchost.exe	85
PID 1376 wrote to memory of 1584	1376	svchost.exe	85
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1112 wrote to memory of 1728	1112	remcos.exe	86
PID 1728 wrote to memory of 4480	1728	svchost.exe	89
PID 1728 wrote to memory of 4480	1728	svchost.exe	89
PID 1728 wrote to memory of 4480	1728	svchost.exe	89
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 1112 wrote to memory of 4596	1112	remcos.exe	90
PID 4596 wrote to memory of 2412	4596	svchost.exe	92
PID 4596 wrote to memory of 2412	4596	svchost.exe	92
PID 4596 wrote to memory of 2412	4596	svchost.exe	92
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 1112 wrote to memory of 2728	1112	remcos.exe	93
PID 2728 wrote to memory of 4716	2728	svchost.exe	95
PID 2728 wrote to memory of 4716	2728	svchost.exe	95
PID 2728 wrote to memory of 4716	2728	svchost.exe	95
PID 1112 wrote to memory of 2244	1112	remcos.exe	96
PID 1112 wrote to memory of 2244	1112	remcos.exe	96
PID 1112 wrote to memory of 2244	1112	remcos.exe	96
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 1112 wrote to memory of 204	1112	remcos.exe	97
PID 204 wrote to memory of 2476	204	svchost.exe	99
PID 204 wrote to memory of 2476	204	svchost.exe	99
PID 204 wrote to memory of 2476	204	svchost.exe	99
PID 204 wrote to memory of 3660	204	svchost.exe	100
PID 204 wrote to memory of 3660	204	svchost.exe	100
PID 204 wrote to memory of 3660	204	svchost.exe	100
PID 1112 wrote to memory of 4352	1112	remcos.exe	101
PID 1112 wrote to memory of 4352	1112	remcos.exe	101
PID 1112 wrote to memory of 4352	1112	remcos.exe	101
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 1112 wrote to memory of 2436	1112	remcos.exe	102
PID 2436 wrote to memory of 1528	2436	svchost.exe	103
PID 2436 wrote to memory of 1528	2436	svchost.exe	103
PID 2436 wrote to memory of 1528	2436	svchost.exe	103
PID 1112 wrote to memory of 4700	1112	remcos.exe	104
PID 1112 wrote to memory of 4700	1112	remcos.exe	104
PID 1112 wrote to memory of 4700	1112	remcos.exe	104
PID 1112 wrote to memory of 4776	1112	remcos.exe	105
PID 1112 wrote to memory of 4776	1112	remcos.exe	105
PID 1112 wrote to memory of 4776	1112	remcos.exe	105
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 1112 wrote to memory of 936	1112	remcos.exe	106
PID 936 wrote to memory of 1632	936	svchost.exe	107
PID 936 wrote to memory of 1632	936	svchost.exe	107
PID 936 wrote to memory of 1632	936	svchost.exe	107
PID 936 wrote to memory of 5000	936	svchost.exe	108
PID 936 wrote to memory of 5000	936	svchost.exe	108
PID 936 wrote to memory of 5000	936	svchost.exe	108
PID 1112 wrote to memory of 3952	1112	remcos.exe	109
PID 1112 wrote to memory of 3952	1112	remcos.exe	109
PID 1112 wrote to memory of 3952	1112	remcos.exe	109
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 1112 wrote to memory of 3960	1112	remcos.exe	110
PID 3960 wrote to memory of 3488	3960	svchost.exe	111
PID 3960 wrote to memory of 3488	3960	svchost.exe	111
PID 3960 wrote to memory of 3488	3960	svchost.exe	111
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 1112 wrote to memory of 3052	1112	remcos.exe	112
PID 3052 wrote to memory of 788	3052	svchost.exe	113
PID 3052 wrote to memory of 788	3052	svchost.exe	113
PID 3052 wrote to memory of 788	3052	svchost.exe	113
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 1112 wrote to memory of 4252	1112	remcos.exe	114
PID 4252 wrote to memory of 4068	4252	svchost.exe	115
PID 4252 wrote to memory of 4068	4252	svchost.exe	115
PID 4252 wrote to memory of 4068	4252	svchost.exe	115
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 1112 wrote to memory of 3824	1112	remcos.exe	116
PID 3824 wrote to memory of 3692	3824	svchost.exe	117
PID 3824 wrote to memory of 3692	3824	svchost.exe	117
PID 3824 wrote to memory of 3692	3824	svchost.exe	117
PID 3824 wrote to memory of 3320	3824	svchost.exe	118
PID 3824 wrote to memory of 3320	3824	svchost.exe	118
PID 3824 wrote to memory of 3320	3824	svchost.exe	118
PID 1112 wrote to memory of 3680	1112	remcos.exe	119
PID 1112 wrote to memory of 3680	1112	remcos.exe	119
PID 1112 wrote to memory of 3680	1112	remcos.exe	119
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 1112 wrote to memory of 3840	1112	remcos.exe	120
PID 3840 wrote to memory of 5044	3840	svchost.exe	121
PID 3840 wrote to memory of 5044	3840	svchost.exe	121
PID 3840 wrote to memory of 5044	3840	svchost.exe	121
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122
PID 1112 wrote to memory of 2092	1112	remcos.exe	122

C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe
"C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe
  "C:\Users\Admin\AppData\Local\Temp\PurchaseOrder#821556_MAY_new_order_products_Tin_Thao_Co.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:644
    - - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:428
      - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 220
        9⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4060
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 224
        9⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 220
        9⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2728
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 220
        9⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:188
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:204
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2436
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:936
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3960
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3052
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:788
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4252
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3824
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3840
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        7⤵
        
        PID:2092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/188-80-0x0000000005650000-0x0000000005651000-memory.dmp

Download

memory/188-75-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/1112-12-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1376-15-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/1376-13-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/1728-20-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/2980-66-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Download

memory/2980-62-0x0000000004260000-0x0000000004261000-memory.dmp

Download

memory/4060-21-0x0000000004990000-0x0000000004991000-memory.dmp

Download

memory/4060-26-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Download

memory/4184-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4184-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4580-52-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/4580-48-0x0000000004550000-0x0000000004551000-memory.dmp

Download