remcos | e1a6a11897a0a813bc3d75da039df3761291a02536d761be50204918ca5a558f

Analysis

max time kernel
149s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
11-01-2021 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER#9403.exe
Size

1.0MB
MD5

81e708966a3317adc0023f3820ddfb0c
SHA1

ec3d3698cb1b706571c776afbec1bafee45b1cb6
SHA256

e1a6a11897a0a813bc3d75da039df3761291a02536d761be50204918ca5a558f
SHA512

8eb1b50d4b9e59af12364c8467b77dec920e3cc6da7c7cc70f6f8b33a49049c3c46cd5af1a16ee900b0cf32469844639f0266fb09b9a1434bf74de8cd96a89ce

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ORDER#9403.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\qqwjW = "C:\\Users\\Admin\\qqwjW.url"	ORDER#9403.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER#9403.exe

description pid process target process

PID 1628 set thread context of 2280 1628 ORDER#9403.exe ORDER#9403.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ORDER#9403.exe

pid process

2280 ORDER#9403.exe

description	pid	process	target process
PID 1628 set thread context of 2280	1628	ORDER#9403.exe	ORDER#9403.exe

pid	process
2280	ORDER#9403.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

ORDER#9403.exe

description	pid	process	target process
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe
PID 1628 wrote to memory of 2280	1628	ORDER#9403.exe	ORDER#9403.exe

C:\Users\Admin\AppData\Local\Temp\ORDER#9403.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER#9403.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Local\Temp\ORDER#9403.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER#9403.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-2-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2280-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2280-4-0x0000000000421000-mapping.dmp

Download