remcos | 09a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c

General

Target

7a99807a434f33b10783b43bc2906fbe.exe
Size

1.3MB
MD5

7a99807a434f33b10783b43bc2906fbe
SHA1

070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA256

09a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512

d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

vlc.exevlc.exe

pid process

2708 vlc.exe
1260 vlc.exe

pid	process
2708	vlc.exe
1260	vlc.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7a99807a434f33b10783b43bc2906fbe.exevlc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	7a99807a434f33b10783b43bc2906fbe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\""	7a99807a434f33b10783b43bc2906fbe.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\""	vlc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs

Processes:

7a99807a434f33b10783b43bc2906fbe.exevlc.exe

pid	process
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

7a99807a434f33b10783b43bc2906fbe.exevlc.exe

description	pid	process	target process
PID 1156 set thread context of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 2708 set thread context of 1260	2708	vlc.exe	vlc.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2500 1156 WerFault.exe 7a99807a434f33b10783b43bc2906fbe.exe
3796 2708 WerFault.exe vlc.exe
Delays execution with timeout.exe 6 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

1000 timeout.exe
212 timeout.exe
456 timeout.exe
3052 timeout.exe
3088 timeout.exe
1248 timeout.exe

pid	pid_target	process	target process
2500	1156	WerFault.exe	7a99807a434f33b10783b43bc2906fbe.exe
3796	2708	WerFault.exe	vlc.exe

pid	process
1000	timeout.exe
212	timeout.exe
456	timeout.exe
3052	timeout.exe
3088	timeout.exe
1248	timeout.exe

Modifies registry class 1 IoCs

Processes:

7a99807a434f33b10783b43bc2906fbe.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	7a99807a434f33b10783b43bc2906fbe.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

7a99807a434f33b10783b43bc2906fbe.exeWerFault.exevlc.exeWerFault.exe

pid	process
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
1156	7a99807a434f33b10783b43bc2906fbe.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2708	vlc.exe
2708	vlc.exe
2708	vlc.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

1260 vlc.exe

pid	process
1260	vlc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

7a99807a434f33b10783b43bc2906fbe.exeWerFault.exevlc.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1156	7a99807a434f33b10783b43bc2906fbe.exe
Token: SeRestorePrivilege	2500	WerFault.exe
Token: SeBackupPrivilege	2500	WerFault.exe
Token: SeDebugPrivilege	2500	WerFault.exe
Token: SeDebugPrivilege	2708	vlc.exe
Token: SeDebugPrivilege	3796	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

1260 vlc.exe

pid	process
1260	vlc.exe

Suspicious use of WriteProcessMemory 68 IoCs

Processes:

7a99807a434f33b10783b43bc2906fbe.execmd.execmd.execmd.exe7a99807a434f33b10783b43bc2906fbe.exeWScript.execmd.exevlc.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1156 wrote to memory of 588	1156	7a99807a434f33b10783b43bc2906fbe.exe	cmd.exe
PID 1156 wrote to memory of 588	1156	7a99807a434f33b10783b43bc2906fbe.exe	cmd.exe
PID 1156 wrote to memory of 588	1156	7a99807a434f33b10783b43bc2906fbe.exe	cmd.exe
PID 588 wrote to memory of 1000	588	cmd.exe	timeout.exe
PID 588 wrote to memory of 1000	588	cmd.exe	timeout.exe
PID 588 wrote to memory of 1000	588	cmd.exe	timeout.exe
PID 1156 wrote to memory of 3824	1156	7a99807a434f33b10783b43bc2906fbe.exe	cmd.exe
PID 1156 wrote to memory of 3824	1156	7a99807a434f33b10783b43bc2906fbe.exe	cmd.exe
PID 1156 wrote to memory of 3824	1156	7a99807a434f33b10783b43bc2906fbe.exe	cmd.exe
PID 3824 wrote to memory of 212	3824	cmd.exe	timeout.exe
PID 3824 wrote to memory of 212	3824	cmd.exe	timeout.exe
PID 3824 wrote to memory of 212	3824	cmd.exe	timeout.exe
PID 1156 wrote to memory of 1420	1156	7a99807a434f33b10783b43bc2906fbe.exe	cmd.exe
PID 1156 wrote to memory of 1420	1156	7a99807a434f33b10783b43bc2906fbe.exe	cmd.exe
PID 1156 wrote to memory of 1420	1156	7a99807a434f33b10783b43bc2906fbe.exe	cmd.exe
PID 1420 wrote to memory of 456	1420	cmd.exe	timeout.exe
PID 1420 wrote to memory of 456	1420	cmd.exe	timeout.exe
PID 1420 wrote to memory of 456	1420	cmd.exe	timeout.exe
PID 1156 wrote to memory of 2552	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2552	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2552	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 1156 wrote to memory of 2536	1156	7a99807a434f33b10783b43bc2906fbe.exe	7a99807a434f33b10783b43bc2906fbe.exe
PID 2536 wrote to memory of 1460	2536	7a99807a434f33b10783b43bc2906fbe.exe	WScript.exe
PID 2536 wrote to memory of 1460	2536	7a99807a434f33b10783b43bc2906fbe.exe	WScript.exe
PID 2536 wrote to memory of 1460	2536	7a99807a434f33b10783b43bc2906fbe.exe	WScript.exe
PID 1460 wrote to memory of 528	1460	WScript.exe	cmd.exe
PID 1460 wrote to memory of 528	1460	WScript.exe	cmd.exe
PID 1460 wrote to memory of 528	1460	WScript.exe	cmd.exe
PID 528 wrote to memory of 2708	528	cmd.exe	vlc.exe
PID 528 wrote to memory of 2708	528	cmd.exe	vlc.exe
PID 528 wrote to memory of 2708	528	cmd.exe	vlc.exe
PID 2708 wrote to memory of 888	2708	vlc.exe	cmd.exe
PID 2708 wrote to memory of 888	2708	vlc.exe	cmd.exe
PID 2708 wrote to memory of 888	2708	vlc.exe	cmd.exe
PID 888 wrote to memory of 3052	888	cmd.exe	timeout.exe
PID 888 wrote to memory of 3052	888	cmd.exe	timeout.exe
PID 888 wrote to memory of 3052	888	cmd.exe	timeout.exe
PID 2708 wrote to memory of 3852	2708	vlc.exe	cmd.exe
PID 2708 wrote to memory of 3852	2708	vlc.exe	cmd.exe
PID 2708 wrote to memory of 3852	2708	vlc.exe	cmd.exe
PID 3852 wrote to memory of 3088	3852	cmd.exe	timeout.exe
PID 3852 wrote to memory of 3088	3852	cmd.exe	timeout.exe
PID 3852 wrote to memory of 3088	3852	cmd.exe	timeout.exe
PID 2708 wrote to memory of 1604	2708	vlc.exe	cmd.exe
PID 2708 wrote to memory of 1604	2708	vlc.exe	cmd.exe
PID 2708 wrote to memory of 1604	2708	vlc.exe	cmd.exe
PID 1604 wrote to memory of 1248	1604	cmd.exe	timeout.exe
PID 1604 wrote to memory of 1248	1604	cmd.exe	timeout.exe
PID 1604 wrote to memory of 1248	1604	cmd.exe	timeout.exe
PID 2708 wrote to memory of 1260	2708	vlc.exe	vlc.exe
PID 2708 wrote to memory of 1260	2708	vlc.exe	vlc.exe
PID 2708 wrote to memory of 1260	2708	vlc.exe	vlc.exe
PID 2708 wrote to memory of 1260	2708	vlc.exe	vlc.exe
PID 2708 wrote to memory of 1260	2708	vlc.exe	vlc.exe
PID 2708 wrote to memory of 1260	2708	vlc.exe	vlc.exe

C:\Users\Admin\AppData\Local\Temp\7a99807a434f33b10783b43bc2906fbe.exe
"C:\Users\Admin\AppData\Local\Temp\7a99807a434f33b10783b43bc2906fbe.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:3824

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:456

C:\Users\Admin\AppData\Local\Temp\7a99807a434f33b10783b43bc2906fbe.exe
"C:\Users\Admin\AppData\Local\Temp\7a99807a434f33b10783b43bc2906fbe.exe"
2⤵
PID:2552

C:\Users\Admin\AppData\Local\Temp\7a99807a434f33b10783b43bc2906fbe.exe
"C:\Users\Admin\AppData\Local\Temp\7a99807a434f33b10783b43bc2906fbe.exe"
2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Users\Admin\AppData\Roaming\vlc.exe
C:\Users\Admin\AppData\Roaming\vlc.exe
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
6⤵
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\timeout.exe
timeout 1
7⤵
- Delays execution with timeout.exe
PID:3052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
6⤵
- Suspicious use of WriteProcessMemory
PID:3852

C:\Windows\SysWOW64\timeout.exe
timeout 1
7⤵
- Delays execution with timeout.exe
PID:3088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
6⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\timeout.exe
timeout 1
7⤵
- Delays execution with timeout.exe
PID:1248

C:\Users\Admin\AppData\Roaming\vlc.exe
"C:\Users\Admin\AppData\Roaming\vlc.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 1116
6⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 1552
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
0fd303b21c1a43c6a9078e6f5280ca85

SHA1
0db8f1ae34f4e2e72184e337951fde826c0bd26f

SHA256
5d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc

SHA512
be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671

Download Submit
C:\Users\Admin\AppData\Roaming\vlc.exe
MD5
7a99807a434f33b10783b43bc2906fbe

SHA1
070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e

SHA256
09a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c

SHA512
d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591

Download Submit
C:\Users\Admin\AppData\Roaming\vlc.exe
MD5
7a99807a434f33b10783b43bc2906fbe

SHA1
070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e

SHA256
09a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c

SHA512
d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591

Download Submit
C:\Users\Admin\AppData\Roaming\vlc.exe
MD5
7a99807a434f33b10783b43bc2906fbe

SHA1
070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e

SHA256
09a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c

SHA512
d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591

Download Submit
memory/212-12-0x0000000000000000-mapping.dmp

Download
memory/456-15-0x0000000000000000-mapping.dmp

Download
memory/528-25-0x0000000000000000-mapping.dmp

Download
memory/588-9-0x0000000000000000-mapping.dmp

Download
memory/888-36-0x0000000000000000-mapping.dmp

Download
memory/1000-10-0x0000000000000000-mapping.dmp

Download
memory/1156-6-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/1156-3-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1156-2-0x0000000073CB0000-0x000000007439E000-memory.dmp

Filesize
6.9MB

Download
memory/1156-13-0x00000000060D0000-0x00000000060D1000-memory.dmp

Filesize
4KB

Download
memory/1156-5-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/1156-8-0x0000000004E10000-0x0000000004E3F000-memory.dmp

Filesize
188KB

Download
memory/1156-7-0x0000000001090000-0x0000000001091000-memory.dmp

Filesize
4KB

Download
memory/1248-42-0x0000000000000000-mapping.dmp

Download
memory/1260-46-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1260-44-0x0000000000413FA4-mapping.dmp

Download
memory/1420-14-0x0000000000000000-mapping.dmp

Download
memory/1460-19-0x0000000000000000-mapping.dmp

Download
memory/1604-41-0x0000000000000000-mapping.dmp

Download
memory/2500-24-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/2500-21-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/2536-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2536-17-0x0000000000413FA4-mapping.dmp

Download
memory/2536-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2708-29-0x0000000073CB0000-0x000000007439E000-memory.dmp

Filesize
6.9MB

Download
memory/2708-26-0x0000000000000000-mapping.dmp

Download
memory/3052-37-0x0000000000000000-mapping.dmp

Download
memory/3088-39-0x0000000000000000-mapping.dmp

Download
memory/3796-47-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/3824-11-0x0000000000000000-mapping.dmp

Download
memory/3852-38-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads