remcos | a4fb793dd11e5ed81d42933185343398edfc35894313d64eca38e672f2d95419

General

Target

Customer_Receivables_Aging_20210112_2663535345242424242.exe
Size

902KB
MD5

2de1de147c59211120377a81f62dc087
SHA1

368cbb3055e620a6ff3b3856eb350d5935afe0ec
SHA256

a4fb793dd11e5ed81d42933185343398edfc35894313d64eca38e672f2d95419
SHA512

52f52e08f4c15677d29b868a701b658765905fc29ca051b42c1e892d84efaee3f5b08b7b59daebb8682a94d23778634195d85d6c7c24a3dd56bf0a5eb2c19000

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Customer_Receivables_Aging_20210112_2663535345242424242.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntlhZ = "C:\\Users\\Admin\\ntlhZ.url"	Customer_Receivables_Aging_20210112_2663535345242424242.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Customer_Receivables_Aging_20210112_2663535345242424242.exe

description	pid	process	target process
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe
PID 1628 wrote to memory of 2504	1628	Customer_Receivables_Aging_20210112_2663535345242424242.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\Customer_Receivables_Aging_20210112_2663535345242424242.exe
"C:\Users\Admin\AppData\Local\Temp\Customer_Receivables_Aging_20210112_2663535345242424242.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1628

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:2504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-2-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2504-3-0x0000000000000000-mapping.dmp

Download
memory/2504-4-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2504-6-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing