remcos | b9dc50480f47cecdd81584b17d81dd4020c5a189c66c48b2a14779870b89c414

General

Target

Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
Size

1.1MB
MD5

ea2f2eb11f583f7ed7f5b72a81847020
SHA1

c435421dd3ae2529fcc84105bda3f18ebf3b53c8
SHA256

b9dc50480f47cecdd81584b17d81dd4020c5a189c66c48b2a14779870b89c414
SHA512

1f0cfaba2000647788f1644523e74b2f6d223502d7442fb9fb2692f4230399115b70d518890a68b0ce7bbfb5889f8c041047abb16357e019df62fe7ecb5a7471

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:7680

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

PxxoServicesTrialNet.exePxxoServicesTrialNet.exe

pid process

1376 PxxoServicesTrialNet.exe
3384 PxxoServicesTrialNet.exe

pid	process
1376	PxxoServicesTrialNet.exe
3384	PxxoServicesTrialNet.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exePxxoServicesTrialNet.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet.exe\""	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	PxxoServicesTrialNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet.exe\""	PxxoServicesTrialNet.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exePxxoServicesTrialNet.exe

description	pid	process	target process
PID 988 set thread context of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 1376 set thread context of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe

Modifies registry class 1 IoCs

Processes:

Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PxxoServicesTrialNet.exe

pid process

3384 PxxoServicesTrialNet.exe

pid	process
3384	PxxoServicesTrialNet.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exeSerfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exeWScript.execmd.exePxxoServicesTrialNet.exe

description	pid	process	target process
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 988 wrote to memory of 2168	988	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
PID 2168 wrote to memory of 2640	2168	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	WScript.exe
PID 2168 wrote to memory of 2640	2168	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	WScript.exe
PID 2168 wrote to memory of 2640	2168	Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe	WScript.exe
PID 2640 wrote to memory of 2876	2640	WScript.exe	cmd.exe
PID 2640 wrote to memory of 2876	2640	WScript.exe	cmd.exe
PID 2640 wrote to memory of 2876	2640	WScript.exe	cmd.exe
PID 2876 wrote to memory of 1376	2876	cmd.exe	PxxoServicesTrialNet.exe
PID 2876 wrote to memory of 1376	2876	cmd.exe	PxxoServicesTrialNet.exe
PID 2876 wrote to memory of 1376	2876	cmd.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe
PID 1376 wrote to memory of 3384	1376	PxxoServicesTrialNet.exe	PxxoServicesTrialNet.exe

C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
"C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:988

C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe
"C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_684040036116902691106340203_812861768738784003105_7475937231065058716664651874_2.exe"
2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet.exe
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1376

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet.exe
"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
bc1b7bd7b69395c7ed2212e2da56f672

SHA1
2b28ea4959b36ae47e07ce1faf03d42738e48811

SHA256
91af85cca199577c0a4aa7bfbf897766138ebae13a61a1986c17a7d911320d06

SHA512
a6e7379da217bfd50b56e8c932b951b976433f773422aa25bf5901f9a6b007cb2deae33370d81dad5dd6b8f85ed48e7890fb8ed80ae4af5300f0ef09c47f1fd9

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet.exe
MD5
ea2f2eb11f583f7ed7f5b72a81847020

SHA1
c435421dd3ae2529fcc84105bda3f18ebf3b53c8

SHA256
b9dc50480f47cecdd81584b17d81dd4020c5a189c66c48b2a14779870b89c414

SHA512
1f0cfaba2000647788f1644523e74b2f6d223502d7442fb9fb2692f4230399115b70d518890a68b0ce7bbfb5889f8c041047abb16357e019df62fe7ecb5a7471

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet.exe
MD5
ea2f2eb11f583f7ed7f5b72a81847020

SHA1
c435421dd3ae2529fcc84105bda3f18ebf3b53c8

SHA256
b9dc50480f47cecdd81584b17d81dd4020c5a189c66c48b2a14779870b89c414

SHA512
1f0cfaba2000647788f1644523e74b2f6d223502d7442fb9fb2692f4230399115b70d518890a68b0ce7bbfb5889f8c041047abb16357e019df62fe7ecb5a7471

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet.exe
MD5
ea2f2eb11f583f7ed7f5b72a81847020

SHA1
c435421dd3ae2529fcc84105bda3f18ebf3b53c8

SHA256
b9dc50480f47cecdd81584b17d81dd4020c5a189c66c48b2a14779870b89c414

SHA512
1f0cfaba2000647788f1644523e74b2f6d223502d7442fb9fb2692f4230399115b70d518890a68b0ce7bbfb5889f8c041047abb16357e019df62fe7ecb5a7471

Download Submit
memory/988-7-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Filesize
4KB

Download
memory/988-2-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/988-3-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/988-5-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/988-6-0x0000000001640000-0x0000000001669000-memory.dmp

Filesize
164KB

Download
memory/1376-14-0x0000000000000000-mapping.dmp

Download
memory/1376-17-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-8-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2168-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2168-9-0x0000000000413FA4-mapping.dmp

Download
memory/2640-11-0x0000000000000000-mapping.dmp

Download
memory/2876-13-0x0000000000000000-mapping.dmp

Download
memory/3384-24-0x0000000000413FA4-mapping.dmp

Download
memory/3384-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads