remcos | 6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff

General

Target

6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
Size

7.6MB
MD5

e8cb5eb80ab232ad7d1ae41e5baabc29
SHA1

a0acc1fba9c81099015b236d7f8ffef6e4dc881c
SHA256

6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff
SHA512

c5a9b3000454c4ae8a6b6993fa6225a0dffeba52eedaf0d890bc1793b76d9b6ea7b5f5604210baac3770f53a0f5a00c9b8ab9bcdbe24be3cf5d422cd94ae5924

Score

10^/10

remcos rat rezer0

Malware Config

Extracted

Family

remcos

C2

CEDSXoissLv2NiM.club:5762

PgqduOYXVZeNNam.xyz:5762

USd7O88wEMlUtX5.xyz:5762

pMfiryhhkiN98Px.xyz:5762

Se2Qwz60L2OxZNM.xyz:5762

GWtY0fiG58DCq6F.xyz:5762

maui16azsncpo97.info:5762

mj99puoba6c3gun.info:5762

tu90to3b4q4uqze.info:5762

cwt1u0vv8ic357ov.info:5762

agaoajz1hrvevre.info:5762

poykoqnl7jkj632.info:5762

cbiq1neygyp1wno.info:5762

BCBNcQ393Z3HPLQ.club:5762

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/300-4-0x0000000004F60000-0x0000000004F88000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe

description	pid	process	target process
PID 300 set thread context of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1072 schtasks.exe

pid	process
1072	schtasks.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe

C:\Users\Admin\AppData\Local\Temp\6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
"C:\Users\Admin\AppData\Local\Temp\6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:300

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KSridAySHa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC04.tmp"
2⤵
- Creates scheduled task(s)
PID:1072

C:\Users\Admin\AppData\Local\Temp\6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
"{path}"
2⤵
PID:1412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEC04.tmp
MD5
a700906a6224808c158165f6383de16e

SHA1
377afabad6d5ecb2d56ed0ae9726ac85d35aab41

SHA256
bfff280eb8acc6159dd58cadcc7a9045d564feb69a0eddfa515b98547713204f

SHA512
5ab102ea23a06cebe4e357fa4c57c79433b7444f6e200559d66acfca2ae3c1346eec2d8f6d5d1d9ad3ebe7d7ded0f089a0e6cf70547ccf1a3fa5d483b159f0ce

Download Submit
memory/300-0-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/300-1-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/300-3-0x0000000000350000-0x0000000000353000-memory.dmp

Filesize
12KB

Download
memory/300-4-0x0000000004F60000-0x0000000004F88000-memory.dmp

Filesize
160KB

Download
memory/1072-5-0x0000000000000000-mapping.dmp

Download
memory/1412-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1412-8-0x0000000000413A84-mapping.dmp

Download
memory/1412-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

description	pid	process	target process
PID 300 wrote to memory of 1072	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	schtasks.exe
PID 300 wrote to memory of 1072	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	schtasks.exe
PID 300 wrote to memory of 1072	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	schtasks.exe
PID 300 wrote to memory of 1072	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	schtasks.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 300 wrote to memory of 1412	300	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads