remcos | 849c170a469dc6f5b1bc190923744b08c51ea0ea593e435f0121b874af58c3ec

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7v20201028
submitted
07/12/2020, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_FILE.EXE
Size 350KB
Sample201207-2npczerssx
SHA256 849c170a469dc6f5b1bc190923744b08c51ea0ea593e435f0121b874af58c3ec
MD5 e4df8e57ffd47c763dd41706043d35a7
SHA1 def3e8326425745a9c7e9979adc450cb3f993fc7
SHA512 61e478df27fa11f4a2428e7076ef5eac76a9e6010fd3ef9422df42965043c96870894ffdb11ece4c0681d82381897557a1bbb38e66670d313b36e25f4e6915ab
MD5 SHA1 SHA512

Score

10^/10

remcos rat spyware

Malware Config

Extracted

Family

remcos

u875414.nvpn.to:2404
u875414.duckdns.org:2404
u875414.ddns.net:2404
u875414.nsupdate.info:2404

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 1084	836	DHL_FILE.EXE	30
PID 1084 set thread context of 1696	1084	DHL_FILE.EXE	33
PID 1084 set thread context of 1480	1084	DHL_FILE.EXE	34

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1696	DHL_FILE.EXE

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
836	DHL_FILE.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1084	DHL_FILE.EXE

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1240	836	DHL_FILE.EXE	29
PID 836 wrote to memory of 1240	836	DHL_FILE.EXE	29
PID 836 wrote to memory of 1240	836	DHL_FILE.EXE	29
PID 836 wrote to memory of 1240	836	DHL_FILE.EXE	29
PID 836 wrote to memory of 1084	836	DHL_FILE.EXE	30
PID 836 wrote to memory of 1084	836	DHL_FILE.EXE	30
PID 836 wrote to memory of 1084	836	DHL_FILE.EXE	30
PID 836 wrote to memory of 1084	836	DHL_FILE.EXE	30
PID 836 wrote to memory of 1084	836	DHL_FILE.EXE	30
PID 1240 wrote to memory of 1248	1240	cmd.exe	32
PID 1240 wrote to memory of 1248	1240	cmd.exe	32
PID 1240 wrote to memory of 1248	1240	cmd.exe	32
PID 1240 wrote to memory of 1248	1240	cmd.exe	32
PID 1084 wrote to memory of 1696	1084	DHL_FILE.EXE	33
PID 1084 wrote to memory of 1696	1084	DHL_FILE.EXE	33
PID 1084 wrote to memory of 1696	1084	DHL_FILE.EXE	33
PID 1084 wrote to memory of 1696	1084	DHL_FILE.EXE	33
PID 1084 wrote to memory of 1696	1084	DHL_FILE.EXE	33
PID 1084 wrote to memory of 1696	1084	DHL_FILE.EXE	33
PID 1084 wrote to memory of 1696	1084	DHL_FILE.EXE	33
PID 1084 wrote to memory of 1696	1084	DHL_FILE.EXE	33
PID 1084 wrote to memory of 1696	1084	DHL_FILE.EXE	33
PID 1084 wrote to memory of 1624	1084	DHL_FILE.EXE	35
PID 1084 wrote to memory of 1624	1084	DHL_FILE.EXE	35
PID 1084 wrote to memory of 1624	1084	DHL_FILE.EXE	35
PID 1084 wrote to memory of 1624	1084	DHL_FILE.EXE	35
PID 1084 wrote to memory of 1480	1084	DHL_FILE.EXE	34
PID 1084 wrote to memory of 1480	1084	DHL_FILE.EXE	34
PID 1084 wrote to memory of 1480	1084	DHL_FILE.EXE	34
PID 1084 wrote to memory of 1480	1084	DHL_FILE.EXE	34
PID 1084 wrote to memory of 1480	1084	DHL_FILE.EXE	34
PID 1084 wrote to memory of 1480	1084	DHL_FILE.EXE	34
PID 1084 wrote to memory of 1480	1084	DHL_FILE.EXE	34
PID 1084 wrote to memory of 1480	1084	DHL_FILE.EXE	34
PID 1084 wrote to memory of 1480	1084	DHL_FILE.EXE	34

C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE
"C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN firefox6 /XML "C:\Users\Admin\AppData\Local\Temp\908fe41669974b699ecdee93824b9fe1.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN firefox6 /XML "C:\Users\Admin\AppData\Local\Temp\908fe41669974b699ecdee93824b9fe1.xml"
    3⤵
    - Creates scheduled task(s)
    PID:1248
- C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE
  "C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE
    C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE /stext "C:\Users\Admin\AppData\Local\Temp\bstqppqqlzbcvaqrihcsdri"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE
    C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE /stext "C:\Users\Admin\AppData\Local\Temp\opebramlnpluhvahjcjnrjxqsrxsoj"
    3⤵
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE
    C:\Users\Admin\AppData\Local\Temp\DHL_FILE.EXE /stext "C:\Users\Admin\AppData\Local\Temp\duzjqibrzhtpxgedzrwloedzjlf"
    3⤵
    PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-3-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1084-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1352-16-0x000007FEF7C70000-0x000007FEF7EEA000-memory.dmp

Download

memory/1480-10-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1480-13-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1480-15-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1696-11-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1696-14-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1696-8-0x0000000000400000-0x0000000000478000-memory.dmp

Download