remcos | a9b710f85ef86429b380e2a96153ea27a21ea201ce8bd81e316420f0c3a435c3

General

Target

0000000000009000.exe
Size

164KB
MD5

e94c75f89c21caad5e32e29ef565a4ff
SHA1

4c95d00080d93d9df0360959db3c9f38a7e80a97
SHA256

a9b710f85ef86429b380e2a96153ea27a21ea201ce8bd81e316420f0c3a435c3
SHA512

3936e7c8692fe4821bd8fa32c8a98d468c855b2a8220d346e1b8d5b356c5540db2566d4949fae0e095b4febe71e52279cc671945ab29bb8ac490a342f793ef17

Score

10^/10

remcos rat spyware

Malware Config

Extracted

Family

remcos

C2

45.137.22.52:8780

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 4 IoCs

Processes:

0000000000009000.exe0000000000009000.exe

description	pid	process	target process
PID 636 set thread context of 1020	636	0000000000009000.exe	0000000000009000.exe
PID 1020 set thread context of 2316	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 set thread context of 3732	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 set thread context of 3068	1020	0000000000009000.exe	0000000000009000.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

200 schtasks.exe

pid	process
200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

0000000000009000.exe0000000000009000.exe

pid	process
2316	0000000000009000.exe
2316	0000000000009000.exe
3732	0000000000009000.exe
3732	0000000000009000.exe
2316	0000000000009000.exe
2316	0000000000009000.exe
2316	0000000000009000.exe
2316	0000000000009000.exe
2316	0000000000009000.exe
2316	0000000000009000.exe
2316	0000000000009000.exe
2316	0000000000009000.exe
2316	0000000000009000.exe
2316	0000000000009000.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

0000000000009000.exe

pid process

636 0000000000009000.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0000000000009000.exe

description pid process

Token: SeDebugPrivilege 3732 0000000000009000.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0000000000009000.exe

pid process

1020 0000000000009000.exe

pid	process
636	0000000000009000.exe

description	pid	process
Token: SeDebugPrivilege	3732	0000000000009000.exe

pid	process
1020	0000000000009000.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

0000000000009000.execmd.exe0000000000009000.exe

description	pid	process	target process
PID 636 wrote to memory of 1904	636	0000000000009000.exe	cmd.exe
PID 636 wrote to memory of 1904	636	0000000000009000.exe	cmd.exe
PID 636 wrote to memory of 1904	636	0000000000009000.exe	cmd.exe
PID 636 wrote to memory of 1020	636	0000000000009000.exe	0000000000009000.exe
PID 636 wrote to memory of 1020	636	0000000000009000.exe	0000000000009000.exe
PID 636 wrote to memory of 1020	636	0000000000009000.exe	0000000000009000.exe
PID 636 wrote to memory of 1020	636	0000000000009000.exe	0000000000009000.exe
PID 1904 wrote to memory of 200	1904	cmd.exe	schtasks.exe
PID 1904 wrote to memory of 200	1904	cmd.exe	schtasks.exe
PID 1904 wrote to memory of 200	1904	cmd.exe	schtasks.exe
PID 1020 wrote to memory of 2316	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 2316	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 2316	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 2316	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 2316	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 2316	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 2316	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 2316	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3732	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3732	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3732	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3732	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3732	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3732	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3732	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3732	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3068	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3068	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3068	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3068	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3068	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3068	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3068	1020	0000000000009000.exe	0000000000009000.exe
PID 1020 wrote to memory of 3068	1020	0000000000009000.exe	0000000000009000.exe

C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe
"C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d62d57f76a8540fab826e8cc40a72ae0.xml"
2⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d62d57f76a8540fab826e8cc40a72ae0.xml"
3⤵
- Creates scheduled task(s)
PID:200

C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe
"C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020

C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe
C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe /stext "C:\Users\Admin\AppData\Local\Temp\rjcly"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316

C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe
C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe /stext "C:\Users\Admin\AppData\Local\Temp\bmhvygga"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe
C:\Users\Admin\AppData\Local\Temp\0000000000009000.exe /stext "C:\Users\Admin\AppData\Local\Temp\egmozyrtund"
3⤵
PID:3068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d62d57f76a8540fab826e8cc40a72ae0.xml
MD5
a36564afc14b3eb0849c01a3afdb9944

SHA1
4dcee9fae3fde4e46b08529bc0ba067150686f07

SHA256
9d4342f763c5d62a06f69aa6fdcb1caa376ff2f2c0972f36b487f73b4d221996

SHA512
782082aa36ae056734e90fc079c813dfef59420571a1b70cde4cf15eb6c870f85b2bfe0748ef4db9df3d010c08671bff744d78178ba75bf2ba02b665f044ae89

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjcly
MD5
74a47b17f3a3ef2bc5e4f2661210d7a1

SHA1
6199a479afcedce924c19ee86a2df3e4b9ea3ca4

SHA256
213bb635eb0518993f6628f436301ec966109d5f77fa937ddc0149204bb1e687

SHA512
829bb52f0c75fb021db780a17817bfdf6a4dfcb2dbe2240923e97f0b575bdd3bb55e41e82070055eb2df4bf45a41cc38f083360c93979352e7a81b5d74715179

Download Submit
memory/200-7-0x0000000000000000-mapping.dmp

Download
memory/1020-3-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1020-4-0x000000000040FD88-mapping.dmp

Download
memory/1020-6-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1904-2-0x0000000000000000-mapping.dmp

Download
memory/2316-9-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2316-10-0x0000000000455274-mapping.dmp

Download
memory/2316-12-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2316-15-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3068-17-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3068-18-0x000000000041C238-mapping.dmp

Download
memory/3068-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3068-20-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3732-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3732-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3732-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3732-13-0x0000000000422206-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads