remcos | 999c9e17b0d164a69bb0224a1231420577b2a4283579e59572f90c32d4daade2

General

Target

a3a675373e72c1f35bc333f988a3b754.exe
Size

5.0MB
MD5

a3a675373e72c1f35bc333f988a3b754
SHA1

9c86091fb649b59959b2f3d8eccfca26e6b2c78a
SHA256

999c9e17b0d164a69bb0224a1231420577b2a4283579e59572f90c32d4daade2
SHA512

7e973d147bb0f0ba1f85c855cd531a78b3198fb90dd5c43f4b0765a72a5e75819c0954b99e158327eeba4645e07454e8505f34a159c73deb256f71c00ffdcbd2

Score

10^/10

remcos persistence rat spyware

Malware Config

Extracted

Family

remcos

C2

ezisec.duckdns.org:2929

38.68.53.190:2929

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a3a675373e72c1f35bc333f988a3b754.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run	a3a675373e72c1f35bc333f988a3b754.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\shwifty = "C:\\users\\Admin\\AppData\\Local\\Temp\\shwifty.exe"	a3a675373e72c1f35bc333f988a3b754.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a3a675373e72c1f35bc333f988a3b754.exe

description pid process target process

PID 476 set thread context of 1052 476 a3a675373e72c1f35bc333f988a3b754.exe a3a675373e72c1f35bc333f988a3b754.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a3a675373e72c1f35bc333f988a3b754.exe

pid process

1052 a3a675373e72c1f35bc333f988a3b754.exe

description	pid	process	target process
PID 476 set thread context of 1052	476	a3a675373e72c1f35bc333f988a3b754.exe	a3a675373e72c1f35bc333f988a3b754.exe

pid	process
1052	a3a675373e72c1f35bc333f988a3b754.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a3a675373e72c1f35bc333f988a3b754.exe

description	pid	process	target process
PID 476 wrote to memory of 1052	476	a3a675373e72c1f35bc333f988a3b754.exe	a3a675373e72c1f35bc333f988a3b754.exe
PID 476 wrote to memory of 1052	476	a3a675373e72c1f35bc333f988a3b754.exe	a3a675373e72c1f35bc333f988a3b754.exe
PID 476 wrote to memory of 1052	476	a3a675373e72c1f35bc333f988a3b754.exe	a3a675373e72c1f35bc333f988a3b754.exe
PID 476 wrote to memory of 1052	476	a3a675373e72c1f35bc333f988a3b754.exe	a3a675373e72c1f35bc333f988a3b754.exe
PID 476 wrote to memory of 1052	476	a3a675373e72c1f35bc333f988a3b754.exe	a3a675373e72c1f35bc333f988a3b754.exe
PID 476 wrote to memory of 1052	476	a3a675373e72c1f35bc333f988a3b754.exe	a3a675373e72c1f35bc333f988a3b754.exe

C:\Users\Admin\AppData\Local\Temp\a3a675373e72c1f35bc333f988a3b754.exe
"C:\Users\Admin\AppData\Local\Temp\a3a675373e72c1f35bc333f988a3b754.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:476

C:\Users\Admin\AppData\Local\Temp\a3a675373e72c1f35bc333f988a3b754.exe
"C:\Users\Admin\AppData\Local\Temp\a3a675373e72c1f35bc333f988a3b754.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-3-0x0000000000413FA4-mapping.dmp

Download
memory/1052-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1052-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing