remcos | e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340

General

Target
e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe
Size 1.1MB
Sample201109-vehyprmkbe
SHA256 e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340
MD5 f2cd52a50bfc7f23dfd78b2dbf52eedc
SHA1 1363783835b1a36e4ca9e2abf06f68782272dbf1
SHA512 8381ef5c5fad34175b7ea7c667c7b5bcc2dab3231cbd503f92c0a22afe102a6319d3056d0f13fb7b050c605ebb203efdaf9c835bb8a0b2ce0df6e78f1710fd82
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 636 set thread context of 3032	636	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	75

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
568	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3032	636	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	75
PID 636 wrote to memory of 3032	636	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	75
PID 636 wrote to memory of 3032	636	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	75
PID 636 wrote to memory of 3032	636	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	75
PID 636 wrote to memory of 3032	636	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	75
PID 3032 wrote to memory of 3264	3032	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	76
PID 3032 wrote to memory of 3264	3032	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	76
PID 3032 wrote to memory of 3264	3032	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	76
PID 636 wrote to memory of 568	636	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	77
PID 636 wrote to memory of 568	636	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	77
PID 636 wrote to memory of 568	636	e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe	77

C:\Users\Admin\AppData\Local\Temp\e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe
"C:\Users\Admin\AppData\Local\Temp\e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe
  "C:\Users\Admin\AppData\Local\Temp\e77ceac98f08984fc5fadbe08e184d75b8e6a172b5ab8bfe2e77d8321158d340.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    PID:3264
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:568