remcos | aeb1aab3be5b90cb85bfe28f0e092c83fee4a742a9cda7b0d8a6e464e6fa7342

Analysis

max time kernel
150s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
06/01/2021, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shipping Document PL&BL003534,pdf.exe
Size 675KB
Sample210106-2lqcmcdhjs
SHA256 aeb1aab3be5b90cb85bfe28f0e092c83fee4a742a9cda7b0d8a6e464e6fa7342
MD5 35d3f86c5715649c8a4273e6a52b0b54
SHA1 cebda0a60751e95d44bf19522c0f315595c47f51
SHA512 b3cec30f5f79de0a31943160687c92d5304f837a8c1de852b5f08682db1c8de1a4f44c13a92c6a37cc34bd842c2d7ebf219501ce52bca0c6a785a93d7dd5a9f4
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

blessings2021.ddns.net:2021

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
3956	remcos.exe
2732	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Shipping Document PL&BL003534,pdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	Shipping Document PL&BL003534,pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 3956 set thread context of 2732	3956	remcos.exe	87

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
592	schtasks.exe
3920	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	Shipping Document PL&BL003534,pdf.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3956	remcos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2732	remcos.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 592	648	Shipping Document PL&BL003534,pdf.exe	78
PID 648 wrote to memory of 592	648	Shipping Document PL&BL003534,pdf.exe	78
PID 648 wrote to memory of 592	648	Shipping Document PL&BL003534,pdf.exe	78
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 648 wrote to memory of 1388	648	Shipping Document PL&BL003534,pdf.exe	80
PID 1388 wrote to memory of 860	1388	Shipping Document PL&BL003534,pdf.exe	81
PID 1388 wrote to memory of 860	1388	Shipping Document PL&BL003534,pdf.exe	81
PID 1388 wrote to memory of 860	1388	Shipping Document PL&BL003534,pdf.exe	81
PID 860 wrote to memory of 3856	860	WScript.exe	82
PID 860 wrote to memory of 3856	860	WScript.exe	82
PID 860 wrote to memory of 3856	860	WScript.exe	82
PID 3856 wrote to memory of 3956	3856	cmd.exe	84
PID 3856 wrote to memory of 3956	3856	cmd.exe	84
PID 3856 wrote to memory of 3956	3856	cmd.exe	84
PID 3956 wrote to memory of 3920	3956	remcos.exe	85
PID 3956 wrote to memory of 3920	3956	remcos.exe	85
PID 3956 wrote to memory of 3920	3956	remcos.exe	85
PID 3956 wrote to memory of 2732	3956	remcos.exe	87
PID 3956 wrote to memory of 2732	3956	remcos.exe	87
PID 3956 wrote to memory of 2732	3956	remcos.exe	87
PID 3956 wrote to memory of 2732	3956	remcos.exe	87
PID 3956 wrote to memory of 2732	3956	remcos.exe	87
PID 3956 wrote to memory of 2732	3956	remcos.exe	87
PID 3956 wrote to memory of 2732	3956	remcos.exe	87
PID 3956 wrote to memory of 2732	3956	remcos.exe	87
PID 3956 wrote to memory of 2732	3956	remcos.exe	87
PID 3956 wrote to memory of 2732	3956	remcos.exe	87

C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL003534,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL003534,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kXLgfvFKbJs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8DF8.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:592
- C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL003534,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL003534,pdf.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3956
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kXLgfvFKbJs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9CF7.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:3920
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:2732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-11-0x0000000006490000-0x00000000064CE000-memory.dmp

Download

memory/648-10-0x0000000005750000-0x0000000005762000-memory.dmp

Download

memory/648-12-0x00000000064D0000-0x00000000064F3000-memory.dmp

Download

memory/648-9-0x0000000005A10000-0x0000000005A11000-memory.dmp

Download

memory/648-8-0x0000000005710000-0x0000000005711000-memory.dmp

Download

memory/648-2-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/648-7-0x0000000005850000-0x0000000005851000-memory.dmp

Download

memory/648-6-0x0000000005D50000-0x0000000005D51000-memory.dmp

Download

memory/648-5-0x00000000057B0000-0x00000000057B1000-memory.dmp

Download

memory/648-3-0x0000000000D20000-0x0000000000D21000-memory.dmp

Download

memory/1388-15-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1388-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2732-40-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3956-24-0x0000000073F80000-0x000000007466E000-memory.dmp

Download