remcos

General

Target
Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3148232413313718104717_pdf.exe
Size 1.9MB
Sample201120-vt8lftwgrx
SHA256 13efba52e6268bbc8089e143010d3e9be11ef8c7606a6ecd32b36e9ff60d1bde
MD5 5b862afb58e54886e055d0de5110e670
SHA1 67fdc5ae1621d50c600f8429f27750b17bfa1196
SHA512 948d99c0f7591e142a158096684480bbe2536750bfcebdebccb1426c959331b1eaa786b7b0b4c041e9ad74511ead257cdc11162cfc95ab02ce7d57849d7f0d12
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:7580

Targets

- Target
  Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3148232413313718104717_pdf.exe
- Size 1.9MB
- SHA256 13efba52e6268bbc8089e143010d3e9be11ef8c7606a6ecd32b36e9ff60d1bde
- MD5 5b862afb58e54886e055d0de5110e670
- SHA1 67fdc5ae1621d50c600f8429f27750b17bfa1196
- SHA512 948d99c0f7591e142a158096684480bbe2536750bfcebdebccb1426c959331b1eaa786b7b0b4c041e9ad74511ead257cdc11162cfc95ab02ce7d57849d7f0d12
- MD5 SHA1 SHA512
Score

10^/10

remcos persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- ServiceHost packer
  Detects ServiceHost packer used for .NET malware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

ServiceHost packer

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2