remcos | 1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e

General

Target

1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe
Size

12.3MB
MD5

bd868158318bdb48e6a445fbe49a3cc0
SHA1

f8d4e93ea520d579264922b5814bf7e110862750
SHA256

1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e
SHA512

ad2fae35737405ae59aa8d283d131ad0db9022f174bf1f1160f619c0d56224fefe736015b1c82b590e41e014b281f3c818753bee593593261f0c48e28cb0ab17

Score

10^/10

remcos rat rezer0

Malware Config

Extracted

Family

remcos

C2

CEDSXoissLv2NiM.club:5762

PgqduOYXVZeNNam.xyz:5762

USd7O88wEMlUtX5.xyz:5762

pMfiryhhkiN98Px.xyz:5762

Se2Qwz60L2OxZNM.xyz:5762

GWtY0fiG58DCq6F.xyz:5762

maui16azsncpo97.info:5762

mj99puoba6c3gun.info:5762

tu90to3b4q4uqze.info:5762

cwt1u0vv8ic357ov.info:5762

agaoajz1hrvevre.info:5762

poykoqnl7jkj632.info:5762

cbiq1neygyp1wno.info:5762

BCBNcQ393Z3HPLQ.club:5762

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/3936-10-0x0000000007EC0000-0x0000000007EE8000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe

description	pid	process	target process
PID 3936 set thread context of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1336 schtasks.exe

pid	process
1336	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe

description	pid	process	target process
PID 3936 wrote to memory of 1336	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	schtasks.exe
PID 3936 wrote to memory of 1336	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	schtasks.exe
PID 3936 wrote to memory of 1336	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	schtasks.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe
PID 3936 wrote to memory of 1500	3936	1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe
"C:\Users\Admin\AppData\Local\Temp\1798895e5928e606be2b611b99758a722f936c9cc92c7ecd76446cc7a2533a3e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YrztqVJUmKh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C9A.tmp"
2⤵
- Creates scheduled task(s)
PID:1336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:1500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6C9A.tmp
MD5
1abbe1941f9e18e7f09ad7be9dc1a1e2

SHA1
3933f3cc31ca4b3861b5dcbb76b07f8ba9538963

SHA256
88980f75034707eaca851c1798aa4fb1a46f9abbd52bed421872cc230212895b

SHA512
5a5b4195bc72da39092a9a214b54803dd6b2aab1c185aa31a195849674b82f4f9e13a444dcb957add1e6179b7ab89a4d4832e0ec4b61726e047892ccfa39bca2

Download Submit
memory/1336-12-0x0000000000000000-mapping.dmp

Download
memory/1500-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1500-15-0x0000000000413A84-mapping.dmp

Download
memory/1500-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3936-5-0x0000000005A70000-0x0000000005A71000-memory.dmp

Filesize
4KB

Download
memory/3936-7-0x0000000005DF0000-0x0000000005DFA000-memory.dmp

Filesize
40KB

Download
memory/3936-8-0x0000000007430000-0x0000000007431000-memory.dmp

Filesize
4KB

Download
memory/3936-9-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/3936-10-0x0000000007EC0000-0x0000000007EE8000-memory.dmp

Filesize
160KB

Download
memory/3936-11-0x0000000007F90000-0x0000000007F91000-memory.dmp

Filesize
4KB

Download
memory/3936-6-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/3936-0-0x0000000073300000-0x00000000739EE000-memory.dmp

Filesize
6.9MB

Download
memory/3936-4-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/3936-3-0x0000000005E30000-0x0000000005E31000-memory.dmp

Filesize
4KB

Download
memory/3936-1-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads