remcos | 826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36

General

Target

826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
Size

7.0MB
MD5

f36c7ece4729f87499cbf12bf35637e5
SHA1

a3b662d9308055d4bd6c5255d457c6f5a07a4a27
SHA256

826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36
SHA512

07e6369ef7434290c02ba9320edc82076eb3bd42a59a2b37554c94dc43adb949e13fbe809c51aed047427ba93c00159678d03187944e10d49e124545bfd63344

Score

10^/10

remcos rat rezer0

Malware Config

Extracted

Family

remcos

C2

CEDSXoissLv2NiM.club:5762

PgqduOYXVZeNNam.xyz:5762

USd7O88wEMlUtX5.xyz:5762

pMfiryhhkiN98Px.xyz:5762

Se2Qwz60L2OxZNM.xyz:5762

GWtY0fiG58DCq6F.xyz:5762

maui16azsncpo97.info:5762

mj99puoba6c3gun.info:5762

tu90to3b4q4uqze.info:5762

cwt1u0vv8ic357ov.info:5762

agaoajz1hrvevre.info:5762

poykoqnl7jkj632.info:5762

cbiq1neygyp1wno.info:5762

BCBNcQ393Z3HPLQ.club:5762

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1916-4-0x0000000004C30000-0x0000000004C58000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe

description	pid	process	target process
PID 1916 set thread context of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1628 schtasks.exe

pid	process
1628	schtasks.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe

C:\Users\Admin\AppData\Local\Temp\826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
"C:\Users\Admin\AppData\Local\Temp\826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KSridAySHa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp230B.tmp"
2⤵
- Creates scheduled task(s)
PID:1628

C:\Users\Admin\AppData\Local\Temp\826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
"{path}"
2⤵
PID:852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp230B.tmp
MD5
a700906a6224808c158165f6383de16e

SHA1
377afabad6d5ecb2d56ed0ae9726ac85d35aab41

SHA256
bfff280eb8acc6159dd58cadcc7a9045d564feb69a0eddfa515b98547713204f

SHA512
5ab102ea23a06cebe4e357fa4c57c79433b7444f6e200559d66acfca2ae3c1346eec2d8f6d5d1d9ad3ebe7d7ded0f089a0e6cf70547ccf1a3fa5d483b159f0ce

Download Submit
memory/852-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/852-8-0x0000000000413A84-mapping.dmp

Download
memory/852-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1628-5-0x0000000000000000-mapping.dmp

Download
memory/1916-0-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/1916-1-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/1916-3-0x0000000000320000-0x0000000000323000-memory.dmp

Filesize
12KB

Download
memory/1916-4-0x0000000004C30000-0x0000000004C58000-memory.dmp

Filesize
160KB

Download

description	pid	process	target process
PID 1916 wrote to memory of 1628	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	schtasks.exe
PID 1916 wrote to memory of 1628	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	schtasks.exe
PID 1916 wrote to memory of 1628	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	schtasks.exe
PID 1916 wrote to memory of 1628	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	schtasks.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe
PID 1916 wrote to memory of 852	1916	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe	826c402e3bccdb488a218f6535dde25aef5f0d219cf5ddf22399644174771d36.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads