remcos | ecee44992b84f86f98c14b5af66451c9e6306e7db33d038cef6d7292988da559

Analysis

max time kernel
147s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
19/12/2020, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2b4d6870c4064039ae9db9ab008ded6.exe
Size 647KB
Sample201219-evzbr9tmzx
SHA256 ecee44992b84f86f98c14b5af66451c9e6306e7db33d038cef6d7292988da559
MD5 d2b4d6870c4064039ae9db9ab008ded6
SHA1 3cb00962e67dfdfd31308cb95bb6917bdcc960cb
SHA512 3268ff855a30b1e7aec5cbbd80203ee80f30a3abc93bdc3651147d94c7675da02461e54541e3a873748cd6cd8cba8b54e22ff6bca1b739a250dcd52e3c0ef8c6
MD5 SHA1 SHA512

Score

10^/10

remcos discovery rat spyware stealer

Malware Config

Extracted

Family

remcos

80.82.77.221:2606

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 3 IoCs

pid	Process
1128	dwn.exe
4028	rundll32.com
552	rundll32.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1316 set thread context of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 2624 set thread context of 1396	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	78
PID 2624 set thread context of 980	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	80
PID 4028 set thread context of 552	4028	rundll32.com	93

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3972	PING.EXE
1384	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1396	d2b4d6870c4064039ae9db9ab008ded6.exe
1396	d2b4d6870c4064039ae9db9ab008ded6.exe
1396	d2b4d6870c4064039ae9db9ab008ded6.exe
1396	d2b4d6870c4064039ae9db9ab008ded6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	d2b4d6870c4064039ae9db9ab008ded6.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4028	rundll32.com
4028	rundll32.com
4028	rundll32.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4028	rundll32.com
4028	rundll32.com
4028	rundll32.com

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 1316 wrote to memory of 2624	1316	d2b4d6870c4064039ae9db9ab008ded6.exe	77
PID 2624 wrote to memory of 1396	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	78
PID 2624 wrote to memory of 1396	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	78
PID 2624 wrote to memory of 1396	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	78
PID 2624 wrote to memory of 1396	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	78
PID 2624 wrote to memory of 1396	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	78
PID 2624 wrote to memory of 1396	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	78
PID 2624 wrote to memory of 1396	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	78
PID 2624 wrote to memory of 1396	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	78
PID 2624 wrote to memory of 1420	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	79
PID 2624 wrote to memory of 1420	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	79
PID 2624 wrote to memory of 1420	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	79
PID 2624 wrote to memory of 980	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	80
PID 2624 wrote to memory of 980	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	80
PID 2624 wrote to memory of 980	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	80
PID 2624 wrote to memory of 980	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	80
PID 2624 wrote to memory of 980	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	80
PID 2624 wrote to memory of 980	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	80
PID 2624 wrote to memory of 980	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	80
PID 2624 wrote to memory of 980	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	80
PID 2624 wrote to memory of 1128	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	82
PID 2624 wrote to memory of 1128	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	82
PID 2624 wrote to memory of 1128	2624	d2b4d6870c4064039ae9db9ab008ded6.exe	82
PID 1128 wrote to memory of 3396	1128	dwn.exe	83
PID 1128 wrote to memory of 3396	1128	dwn.exe	83
PID 1128 wrote to memory of 3396	1128	dwn.exe	83
PID 1128 wrote to memory of 2092	1128	dwn.exe	85
PID 1128 wrote to memory of 2092	1128	dwn.exe	85
PID 1128 wrote to memory of 2092	1128	dwn.exe	85
PID 2092 wrote to memory of 1084	2092	cmd.exe	87
PID 2092 wrote to memory of 1084	2092	cmd.exe	87
PID 2092 wrote to memory of 1084	2092	cmd.exe	87
PID 1084 wrote to memory of 3972	1084	cmd.exe	88
PID 1084 wrote to memory of 3972	1084	cmd.exe	88
PID 1084 wrote to memory of 3972	1084	cmd.exe	88
PID 1084 wrote to memory of 4052	1084	cmd.exe	89
PID 1084 wrote to memory of 4052	1084	cmd.exe	89
PID 1084 wrote to memory of 4052	1084	cmd.exe	89
PID 1084 wrote to memory of 564	1084	cmd.exe	90
PID 1084 wrote to memory of 564	1084	cmd.exe	90
PID 1084 wrote to memory of 564	1084	cmd.exe	90
PID 1084 wrote to memory of 4028	1084	cmd.exe	91
PID 1084 wrote to memory of 4028	1084	cmd.exe	91
PID 1084 wrote to memory of 4028	1084	cmd.exe	91
PID 1084 wrote to memory of 1384	1084	cmd.exe	92
PID 1084 wrote to memory of 1384	1084	cmd.exe	92
PID 1084 wrote to memory of 1384	1084	cmd.exe	92
PID 4028 wrote to memory of 552	4028	rundll32.com	93
PID 4028 wrote to memory of 552	4028	rundll32.com	93
PID 4028 wrote to memory of 552	4028	rundll32.com	93
PID 4028 wrote to memory of 552	4028	rundll32.com	93
PID 4028 wrote to memory of 552	4028	rundll32.com	93

C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe
"C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe
  "C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe
    C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe /stext "C:\Users\Admin\AppData\Local\Temp\dfcermltdadwejanqoobjhoymqowv"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe
    C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe /stext "C:\Users\Admin\AppData\Local\Temp\nhhxrewvzivbgporhzicmljhnwyfolgp"
    3⤵
    PID:1420
- - C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe
    C:\Users\Admin\AppData\Local\Temp\d2b4d6870c4064039ae9db9ab008ded6.exe /stext "C:\Users\Admin\AppData\Local\Temp\xbnp"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\dwn.exe
    "C:\Users\Admin\AppData\Local\Temp\dwn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo iistmhuqu
      4⤵
      PID:3396
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cmd < trlcybjgmzp.com
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1084
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 xtvtnis
        6⤵
        Runs ping.exe
        
        PID:3972
      - C:\Windows\SysWOW64\certutil.exe
        
        certutil -decode qrjohyfiklf.com rundll32.com
        6⤵
        
        PID:4052
      - C:\Windows\SysWOW64\certutil.exe
        
        certutil -decode xwybywp.com fkwehcxca.com
        6⤵
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rundll32.com
        
        rundll32.com fkwehcxca.com
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rundll32.com
        
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rundll32.com"
        7⤵
        Executes dropped EXE
        
        PID:552
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 xtvtnis
        6⤵
        Runs ping.exe
        
        PID:1384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/552-42-0x0000000000A10000-0x0000000000A47000-memory.dmp

Download

memory/552-45-0x0000000000A10000-0x0000000000A47000-memory.dmp

Download

memory/980-17-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/980-22-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/980-20-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1316-11-0x0000000008330000-0x0000000008331000-memory.dmp

Download

memory/1316-2-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1316-3-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/1316-5-0x00000000056D0000-0x00000000056D1000-memory.dmp

Download

memory/1316-6-0x0000000003240000-0x0000000003257000-memory.dmp

Download

memory/1316-7-0x0000000005690000-0x00000000056AF000-memory.dmp

Download

memory/1316-8-0x0000000008370000-0x0000000008371000-memory.dmp

Download

memory/1316-9-0x0000000007F60000-0x0000000007F61000-memory.dmp

Download

memory/1316-10-0x0000000007F40000-0x0000000007F4A000-memory.dmp

Download

memory/1396-15-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1396-21-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1396-18-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2624-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2624-14-0x0000000000400000-0x0000000000421000-memory.dmp

Download