remcos | af5e020c1ac3f3590036495b28ebad3153c66986da343142db222a5df5d42b2d

General

Target

Urgent order 1812021-672 Q30721,pdf.exe
Size

888KB
MD5

5f4f037e04be43a34b342e4e481e1a90
SHA1

3fdada0e5c3a0e73f38f5b5bc16c13323ad30ff4
SHA256

af5e020c1ac3f3590036495b28ebad3153c66986da343142db222a5df5d42b2d
SHA512

172f0130ac9d93ca31ba0af555cf8314d94be50cdba9b4ad0278a1d866d028e84020df95269ad56274621d3671d9871c85d8543d17fa6591694febf417e33a89

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

goddywin.freedynamicdns.net:2525

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

Urgent order 1812021-672 Q30721,pdf.exe

description	pid	process	target process
PID 4704 set thread context of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4072 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Urgent order 1812021-672 Q30721,pdf.exe

pid process

4704 Urgent order 1812021-672 Q30721,pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Urgent order 1812021-672 Q30721,pdf.exe

description pid process

Token: SeDebugPrivilege 4704 Urgent order 1812021-672 Q30721,pdf.exe

pid	process
4072	schtasks.exe

pid	process
4704	Urgent order 1812021-672 Q30721,pdf.exe

description	pid	process
Token: SeDebugPrivilege	4704	Urgent order 1812021-672 Q30721,pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Urgent order 1812021-672 Q30721,pdf.exe

description	pid	process	target process
PID 4704 wrote to memory of 4072	4704	Urgent order 1812021-672 Q30721,pdf.exe	schtasks.exe
PID 4704 wrote to memory of 4072	4704	Urgent order 1812021-672 Q30721,pdf.exe	schtasks.exe
PID 4704 wrote to memory of 4072	4704	Urgent order 1812021-672 Q30721,pdf.exe	schtasks.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe
PID 4704 wrote to memory of 3036	4704	Urgent order 1812021-672 Q30721,pdf.exe	Urgent order 1812021-672 Q30721,pdf.exe

C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yQrHLa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDCE8.tmp"
2⤵
- Creates scheduled task(s)
PID:4072

C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe
"{path}"
2⤵
PID:3036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDCE8.tmp
MD5
9357fabda24788acd37bc93214a13a47

SHA1
23b63d4ca08e8b0e6c69db15fefa3c6aad0a2b15

SHA256
4a36d147c3bdd8d51cfc930b30db97863fc17ad857c4d2da032c65a3302bfbe0

SHA512
b735f4a7406cbb218cf5108436ef8955d55379e54d67397182c07072fbaaa892d3413536a029865ffba0bf5fe8c1d3482e7cb1786be37a9a30b1012f0dae2826

Download Submit
memory/3036-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3036-15-0x0000000000413FA4-mapping.dmp

Download
memory/3036-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4072-12-0x0000000000000000-mapping.dmp

Download
memory/4704-6-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/4704-9-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/4704-10-0x0000000006900000-0x000000000694E000-memory.dmp

Filesize
312KB

Download
memory/4704-11-0x0000000006FF0000-0x0000000006FF1000-memory.dmp

Filesize
4KB

Download
memory/4704-8-0x0000000004EA0000-0x0000000004EAE000-memory.dmp

Filesize
56KB

Download
memory/4704-7-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/4704-2-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download
memory/4704-5-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/4704-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads