remcos | ec61eb67057660a18fa9d4465b12830c2bbded3234a401dd441176db16176803

General

Target

GST Invoice - No.SKDC2001006133.exe
Size

1.3MB
MD5

807d184706be5d985443653bab74c2a7
SHA1

2ffb77203c1fa719e7df160a11fb2462843ed1b5
SHA256

ec61eb67057660a18fa9d4465b12830c2bbded3234a401dd441176db16176803
SHA512

30cdd2733a9a371d8b4a1d2f068f65b3190a29a31c4350e33264fb6263ddd887af95172983866be00eb3b45dbcd6c4b2da319e74aeb49ced7cb2b6e50e41324b

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

212.83.46.26:4023

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

GST Invoice - No.SKDC2001006133.exe

description pid process target process

PID 616 set thread context of 512 616 GST Invoice - No.SKDC2001006133.exe GST Invoice - No.SKDC2001006133.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

488 schtasks.exe

description	pid	process	target process
PID 616 set thread context of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe

pid	process
488	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

GST Invoice - No.SKDC2001006133.exe

description	pid	process	target process
PID 616 wrote to memory of 488	616	GST Invoice - No.SKDC2001006133.exe	schtasks.exe
PID 616 wrote to memory of 488	616	GST Invoice - No.SKDC2001006133.exe	schtasks.exe
PID 616 wrote to memory of 488	616	GST Invoice - No.SKDC2001006133.exe	schtasks.exe
PID 616 wrote to memory of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe
PID 616 wrote to memory of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe
PID 616 wrote to memory of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe
PID 616 wrote to memory of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe
PID 616 wrote to memory of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe
PID 616 wrote to memory of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe
PID 616 wrote to memory of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe
PID 616 wrote to memory of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe
PID 616 wrote to memory of 512	616	GST Invoice - No.SKDC2001006133.exe	GST Invoice - No.SKDC2001006133.exe

C:\Users\Admin\AppData\Local\Temp\GST Invoice - No.SKDC2001006133.exe
"C:\Users\Admin\AppData\Local\Temp\GST Invoice - No.SKDC2001006133.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xmsCRXmKQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp82DD.tmp"
2⤵
- Creates scheduled task(s)
PID:488

C:\Users\Admin\AppData\Local\Temp\GST Invoice - No.SKDC2001006133.exe
"C:\Users\Admin\AppData\Local\Temp\GST Invoice - No.SKDC2001006133.exe"
2⤵
PID:512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp82DD.tmp
MD5
a74d666f5893647b55e4e14e4aeb258a

SHA1
adb5e204d84439a08512fb6ed1a164cadfce2cfb

SHA256
652b6ce54b32e0ba0288c74c0d6acc9ac2182e93464a3ab97e18c51dddfd6996

SHA512
ed44622a5301804252eff38ad5bbd7b940e43259bff812abc5576abc6667a50ffd7cc0b0be90608ffb059a55c18ebaac577c31b69d70e64d23d210b47af3eebf

Download Submit
memory/488-12-0x0000000000000000-mapping.dmp

Download
memory/512-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/512-15-0x000000000040FD88-mapping.dmp

Download
memory/512-14-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/616-6-0x0000000005B00000-0x0000000005B01000-memory.dmp

Filesize
4KB

Download
memory/616-9-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/616-10-0x0000000005800000-0x0000000005812000-memory.dmp

Filesize
72KB

Download
memory/616-11-0x0000000006420000-0x00000000064C5000-memory.dmp

Filesize
660KB

Download
memory/616-8-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/616-7-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/616-2-0x0000000073160000-0x000000007384E000-memory.dmp

Filesize
6.9MB

Download
memory/616-5-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/616-3-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads