remcos | ece0f92110b68a8d7cd1d4a3099011d26d57670923e9e20328def2553ab69cbc | Triage

Sharing

General

Target

ADJUNTO_SERFINANZA_1749215776698168558271_4803580771640956644_454732582763146614603879886660_0156881393079417053956926_pdf.exe
Size

1.2MB
Sample

201228-b29pw7956e
MD5

a109c83108f15a49b4941c966e2630ee
SHA1

058a543f6b3b4fcc301401a8b04944ad6e7625d7
SHA256

ece0f92110b68a8d7cd1d4a3099011d26d57670923e9e20328def2553ab69cbc
SHA512

7a81cb1750c84cf6eafe343a82dfcc57aa1eb1b58e15b9b5cf0d7b780878bae4c49a0d3c5db2763b6367a73b3e727856f853754985b88d6fc5c19813aebfd5c1

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:7680

Targets

- Target
  
  ADJUNTO_SERFINANZA_1749215776698168558271_4803580771640956644_454732582763146614603879886660_0156881393079417053956926_pdf.exe
- Size
  
  1.2MB
- MD5
  
  a109c83108f15a49b4941c966e2630ee
- SHA1
  
  058a543f6b3b4fcc301401a8b04944ad6e7625d7
- SHA256
  
  ece0f92110b68a8d7cd1d4a3099011d26d57670923e9e20328def2553ab69cbc
- SHA512
  
  7a81cb1750c84cf6eafe343a82dfcc57aa1eb1b58e15b9b5cf0d7b780878bae4c49a0d3c5db2763b6367a73b3e727856f853754985b88d6fc5c19813aebfd5c1
Score

10^/10

remcos persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

remcospersistencerat

behavioral2

remcospersistencerat