remcos | 6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff

General

Target

6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
Size

7.6MB
MD5

e8cb5eb80ab232ad7d1ae41e5baabc29
SHA1

a0acc1fba9c81099015b236d7f8ffef6e4dc881c
SHA256

6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff
SHA512

c5a9b3000454c4ae8a6b6993fa6225a0dffeba52eedaf0d890bc1793b76d9b6ea7b5f5604210baac3770f53a0f5a00c9b8ab9bcdbe24be3cf5d422cd94ae5924

Score

10^/10

remcos rat rezer0

Malware Config

Extracted

Family

remcos

C2

CEDSXoissLv2NiM.club:5762

PgqduOYXVZeNNam.xyz:5762

USd7O88wEMlUtX5.xyz:5762

pMfiryhhkiN98Px.xyz:5762

Se2Qwz60L2OxZNM.xyz:5762

GWtY0fiG58DCq6F.xyz:5762

maui16azsncpo97.info:5762

mj99puoba6c3gun.info:5762

tu90to3b4q4uqze.info:5762

cwt1u0vv8ic357ov.info:5762

agaoajz1hrvevre.info:5762

poykoqnl7jkj632.info:5762

cbiq1neygyp1wno.info:5762

BCBNcQ393Z3HPLQ.club:5762

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/3132-8-0x00000000055A0000-0x00000000055C8000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe

description	pid	process	target process
PID 3132 set thread context of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3772 schtasks.exe

pid	process
3772	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe

description	pid	process	target process
PID 3132 wrote to memory of 3772	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	schtasks.exe
PID 3132 wrote to memory of 3772	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	schtasks.exe
PID 3132 wrote to memory of 3772	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	schtasks.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
PID 3132 wrote to memory of 1512	3132	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe	6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe

C:\Users\Admin\AppData\Local\Temp\6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
"C:\Users\Admin\AppData\Local\Temp\6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3132

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KSridAySHa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9B5B.tmp"
2⤵
- Creates scheduled task(s)
PID:3772

C:\Users\Admin\AppData\Local\Temp\6460ce9a904ae76454bf01cad136fcc608811701f2b28926f72d542fa2793bff.exe
"{path}"
2⤵
PID:1512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9B5B.tmp
MD5
2823d42c882b402b029ef41da3771b26

SHA1
d99b7c8f2ce6ca524c2775353b4ad8aeea72615c

SHA256
b1b914415259fc45cb5b939124918521baf24abd651ed1ada78973bf5eb5a9f1

SHA512
e038a22f7fac6ac1c2701118563466ade96835924fdb318f43f6bde127e58fa37b8545d575ad398301bb993ac947accd43fa9a43179a6876f0ab756fcfda4fe6

Download Submit
memory/1512-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1512-12-0x0000000000413A84-mapping.dmp

Download
memory/1512-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3132-4-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/3132-6-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/3132-7-0x0000000005260000-0x0000000005263000-memory.dmp

Filesize
12KB

Download
memory/3132-8-0x00000000055A0000-0x00000000055C8000-memory.dmp

Filesize
160KB

Download
memory/3132-5-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/3132-0-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/3132-3-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/3132-1-0x0000000000040000-0x0000000000041000-memory.dmp

Filesize
4KB

Download
memory/3772-9-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads