remcos | d72b99be6c28cec8f3672df1ef58a69cb08524e181fb7ba53edbdab73f3ccf44

Analysis

max time kernel
19s
max time network
134s
platform
windows10_x64
resource
win10v20201028
submitted
08/12/2020, 08:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mozoon Tower Project-ORDER.exe
Size 135KB
Sample201208-eqv4j6p2qj
SHA256 d72b99be6c28cec8f3672df1ef58a69cb08524e181fb7ba53edbdab73f3ccf44
MD5 464892fe44572f2616f19d8d6f951838
SHA1 de0eeab84ab31976766db59bffb1269ee178034c
SHA512 6ac4314391953e9f63af909909793e22f2c03373828383542011c98b0310846eb2e31dc271a43761cb542a03e56e72df1af2535d6871d3c5845760ab1d9aa1c6
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

beckz.duckdns.org:6011

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 8 IoCs

pid	Process
2944	wat.exe
3600	wat.exe
3584	wat.exe
1444	wat.exe
3680	wat.exe
3380	wat.exe
1160	wat.exe
2136	wat.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Mozoon Tower Project-ORDER.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\wat\\wat.exe\""	Mozoon Tower Project-ORDER.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	wat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\wat\\wat.exe\""	wat.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3588 set thread context of 772	3588	Mozoon Tower Project-ORDER.exe	77
PID 1160 set thread context of 2136	1160	wat.exe	88

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2744	PING.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
576	Mozoon Tower Project-ORDER.exe
3588	Mozoon Tower Project-ORDER.exe
2944	wat.exe
3584	wat.exe
3680	wat.exe
1160	wat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2136	wat.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 3924	576	Mozoon Tower Project-ORDER.exe	75
PID 576 wrote to memory of 3924	576	Mozoon Tower Project-ORDER.exe	75
PID 576 wrote to memory of 3924	576	Mozoon Tower Project-ORDER.exe	75
PID 576 wrote to memory of 3588	576	Mozoon Tower Project-ORDER.exe	76
PID 576 wrote to memory of 3588	576	Mozoon Tower Project-ORDER.exe	76
PID 576 wrote to memory of 3588	576	Mozoon Tower Project-ORDER.exe	76
PID 3588 wrote to memory of 772	3588	Mozoon Tower Project-ORDER.exe	77
PID 3588 wrote to memory of 772	3588	Mozoon Tower Project-ORDER.exe	77
PID 3588 wrote to memory of 772	3588	Mozoon Tower Project-ORDER.exe	77
PID 3588 wrote to memory of 772	3588	Mozoon Tower Project-ORDER.exe	77
PID 772 wrote to memory of 2956	772	Mozoon Tower Project-ORDER.exe	78
PID 772 wrote to memory of 2956	772	Mozoon Tower Project-ORDER.exe	78
PID 772 wrote to memory of 2956	772	Mozoon Tower Project-ORDER.exe	78
PID 2956 wrote to memory of 2744	2956	cmd.exe	80
PID 2956 wrote to memory of 2744	2956	cmd.exe	80
PID 2956 wrote to memory of 2744	2956	cmd.exe	80
PID 2956 wrote to memory of 2944	2956	cmd.exe	81
PID 2956 wrote to memory of 2944	2956	cmd.exe	81
PID 2956 wrote to memory of 2944	2956	cmd.exe	81
PID 2944 wrote to memory of 3600	2944	wat.exe	82
PID 2944 wrote to memory of 3600	2944	wat.exe	82
PID 2944 wrote to memory of 3600	2944	wat.exe	82
PID 2944 wrote to memory of 3584	2944	wat.exe	83
PID 2944 wrote to memory of 3584	2944	wat.exe	83
PID 2944 wrote to memory of 3584	2944	wat.exe	83
PID 3584 wrote to memory of 1444	3584	wat.exe	84
PID 3584 wrote to memory of 1444	3584	wat.exe	84
PID 3584 wrote to memory of 1444	3584	wat.exe	84
PID 3584 wrote to memory of 3680	3584	wat.exe	85
PID 3584 wrote to memory of 3680	3584	wat.exe	85
PID 3584 wrote to memory of 3680	3584	wat.exe	85
PID 3680 wrote to memory of 3380	3680	wat.exe	86
PID 3680 wrote to memory of 3380	3680	wat.exe	86
PID 3680 wrote to memory of 3380	3680	wat.exe	86
PID 3680 wrote to memory of 1160	3680	wat.exe	87
PID 3680 wrote to memory of 1160	3680	wat.exe	87
PID 3680 wrote to memory of 1160	3680	wat.exe	87
PID 1160 wrote to memory of 2136	1160	wat.exe	88
PID 1160 wrote to memory of 2136	1160	wat.exe	88
PID 1160 wrote to memory of 2136	1160	wat.exe	88
PID 1160 wrote to memory of 2136	1160	wat.exe	88

C:\Users\Admin\AppData\Local\Temp\Mozoon Tower Project-ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\Mozoon Tower Project-ORDER.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:576
- C:\Users\Admin\AppData\Local\Temp\Mozoon Tower Project-ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\Mozoon Tower Project-ORDER.exe"
  2⤵
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\Mozoon Tower Project-ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\Mozoon Tower Project-ORDER.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Mozoon Tower Project-ORDER.exe
    "C:\Users\Admin\AppData\Local\Temp\Mozoon Tower Project-ORDER.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Windows\SysWOW64\PING.EXE
        
        PING 127.0.0.1 -n 2
        5⤵
        Runs ping.exe
        
        PID:2744
    - - C:\Users\Admin\AppData\Roaming\wat\wat.exe
        
        "C:\Users\Admin\AppData\Roaming\wat\wat.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Users\Admin\AppData\Roaming\wat\wat.exe
        
        "C:\Users\Admin\AppData\Roaming\wat\wat.exe"
        6⤵
        Executes dropped EXE
        
        PID:3600
      - C:\Users\Admin\AppData\Roaming\wat\wat.exe
        
        "C:\Users\Admin\AppData\Roaming\wat\wat.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Users\Admin\AppData\Roaming\wat\wat.exe
        
        "C:\Users\Admin\AppData\Roaming\wat\wat.exe"
        7⤵
        Executes dropped EXE
        
        PID:1444
        
        C:\Users\Admin\AppData\Roaming\wat\wat.exe
        
        "C:\Users\Admin\AppData\Roaming\wat\wat.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Users\Admin\AppData\Roaming\wat\wat.exe
        
        "C:\Users\Admin\AppData\Roaming\wat\wat.exe"
        8⤵
        Executes dropped EXE
        
        PID:3380
        
        C:\Users\Admin\AppData\Roaming\wat\wat.exe
        
        "C:\Users\Admin\AppData\Roaming\wat\wat.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Users\Admin\AppData\Roaming\wat\wat.exe
        
        "C:\Users\Admin\AppData\Roaming\wat\wat.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:2136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-6-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/772-3-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1160-26-0x0000000000B90000-0x0000000000BA7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads