remcos | bcacb340582be7a1764da1d56bd4e86d027987eb6a985ca973fa9d1509eb0863

Analysis

max time kernel
149s
max time network
145s
platform
windows10_x64
resource
win10v20201028
submitted
19/01/2021, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SWIFT.exe
Size 167KB
Sample210119-3tyq6vbk3s
SHA256 bcacb340582be7a1764da1d56bd4e86d027987eb6a985ca973fa9d1509eb0863
MD5 ea93512c5e7bba30c5a4dc3f4e51e6c8
SHA1 b8b576dd30be1e279567e780edcc00067515d727
SHA512 829cd745f7c8ab83d54aa45ad0e8916e1ff465e26f7af6427bc459f7a79eaa34ef6b2ea328b28bb6818ea2d49cb28e6d87b0f0bc1e60e22ae3654de06f284239
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat spyware

Malware Config

Extracted

Family

remcos

whatgodcannotdodoestnotexist.duckdns.org:2889

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3204-21-0x0000000000476274-mapping.dmp	WebBrowserPassView

Nirsoft 2 IoCs

resource	yara_rule
behavioral2/memory/3204-21-0x0000000000476274-mapping.dmp	Nirsoft
behavioral2/memory/3520-24-0x0000000000422206-mapping.dmp	Nirsoft

Executes dropped EXE 7 IoCs

pid	Process
3864	remcos.exe
588	remcos.exe
4028	remcos.exe
4040	remcos.exe
3204	remcos.exe
3520	remcos.exe
1076	remcos.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SWIFT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	SWIFT.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3356 set thread context of 3440	3356	SWIFT.exe	79
PID 4028 set thread context of 4040	4028	remcos.exe	87
PID 4040 set thread context of 3204	4040	remcos.exe	90
PID 4040 set thread context of 3520	4040	remcos.exe	91
PID 4040 set thread context of 1076	4040	remcos.exe	92

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
188	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	SWIFT.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3204	remcos.exe
3204	remcos.exe
3520	remcos.exe
3520	remcos.exe
3204	remcos.exe
3204	remcos.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3084	SWIFT.exe
3356	SWIFT.exe
3864	remcos.exe
4028	remcos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4040	remcos.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 3876	3084	SWIFT.exe	75
PID 3084 wrote to memory of 3876	3084	SWIFT.exe	75
PID 3084 wrote to memory of 3876	3084	SWIFT.exe	75
PID 3084 wrote to memory of 3952	3084	SWIFT.exe	76
PID 3084 wrote to memory of 3952	3084	SWIFT.exe	76
PID 3084 wrote to memory of 3952	3084	SWIFT.exe	76
PID 3084 wrote to memory of 3356	3084	SWIFT.exe	78
PID 3084 wrote to memory of 3356	3084	SWIFT.exe	78
PID 3084 wrote to memory of 3356	3084	SWIFT.exe	78
PID 3356 wrote to memory of 3440	3356	SWIFT.exe	79
PID 3356 wrote to memory of 3440	3356	SWIFT.exe	79
PID 3356 wrote to memory of 3440	3356	SWIFT.exe	79
PID 3356 wrote to memory of 3440	3356	SWIFT.exe	79
PID 3876 wrote to memory of 188	3876	cmd.exe	80
PID 3876 wrote to memory of 188	3876	cmd.exe	80
PID 3876 wrote to memory of 188	3876	cmd.exe	80
PID 3440 wrote to memory of 4000	3440	SWIFT.exe	81
PID 3440 wrote to memory of 4000	3440	SWIFT.exe	81
PID 3440 wrote to memory of 4000	3440	SWIFT.exe	81
PID 4000 wrote to memory of 748	4000	WScript.exe	82
PID 4000 wrote to memory of 748	4000	WScript.exe	82
PID 4000 wrote to memory of 748	4000	WScript.exe	82
PID 748 wrote to memory of 3864	748	cmd.exe	84
PID 748 wrote to memory of 3864	748	cmd.exe	84
PID 748 wrote to memory of 3864	748	cmd.exe	84
PID 3864 wrote to memory of 588	3864	remcos.exe	85
PID 3864 wrote to memory of 588	3864	remcos.exe	85
PID 3864 wrote to memory of 588	3864	remcos.exe	85
PID 3864 wrote to memory of 4028	3864	remcos.exe	86
PID 3864 wrote to memory of 4028	3864	remcos.exe	86
PID 3864 wrote to memory of 4028	3864	remcos.exe	86
PID 4028 wrote to memory of 4040	4028	remcos.exe	87
PID 4028 wrote to memory of 4040	4028	remcos.exe	87
PID 4028 wrote to memory of 4040	4028	remcos.exe	87
PID 4028 wrote to memory of 4040	4028	remcos.exe	87
PID 4040 wrote to memory of 3204	4040	remcos.exe	90
PID 4040 wrote to memory of 3204	4040	remcos.exe	90
PID 4040 wrote to memory of 3204	4040	remcos.exe	90
PID 4040 wrote to memory of 3204	4040	remcos.exe	90
PID 4040 wrote to memory of 3204	4040	remcos.exe	90
PID 4040 wrote to memory of 3204	4040	remcos.exe	90
PID 4040 wrote to memory of 3204	4040	remcos.exe	90
PID 4040 wrote to memory of 3204	4040	remcos.exe	90
PID 4040 wrote to memory of 3520	4040	remcos.exe	91
PID 4040 wrote to memory of 3520	4040	remcos.exe	91
PID 4040 wrote to memory of 3520	4040	remcos.exe	91
PID 4040 wrote to memory of 3520	4040	remcos.exe	91
PID 4040 wrote to memory of 3520	4040	remcos.exe	91
PID 4040 wrote to memory of 3520	4040	remcos.exe	91
PID 4040 wrote to memory of 3520	4040	remcos.exe	91
PID 4040 wrote to memory of 3520	4040	remcos.exe	91
PID 4040 wrote to memory of 1076	4040	remcos.exe	92
PID 4040 wrote to memory of 1076	4040	remcos.exe	92
PID 4040 wrote to memory of 1076	4040	remcos.exe	92
PID 4040 wrote to memory of 1076	4040	remcos.exe	92
PID 4040 wrote to memory of 1076	4040	remcos.exe	92
PID 4040 wrote to memory of 1076	4040	remcos.exe	92
PID 4040 wrote to memory of 1076	4040	remcos.exe	92
PID 4040 wrote to memory of 1076	4040	remcos.exe	92

C:\Users\Admin\AppData\Local\Temp\SWIFT.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\335690eb165b4aef803128cd2c18e510.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\335690eb165b4aef803128cd2c18e510.xml"
    3⤵
    - Creates scheduled task(s)
    PID:188
- C:\Users\Admin\AppData\Local\Temp\SWIFT.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"
  2⤵
  PID:3952
- C:\Users\Admin\AppData\Local\Temp\SWIFT.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Users\Admin\AppData\Local\Temp\SWIFT.exe
    "C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:748
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        7⤵
        Executes dropped EXE
        
        PID:588
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\kfcstwswszditgtydrfjimr"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3204
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\nhpluodxghvnwmpcmcsllzljid"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\xcudugoruqnsgadgvmfewegrircufk"
        9⤵
        Executes dropped EXE
        
        PID:1076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-31-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1076-26-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3204-29-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3204-20-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3440-9-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3520-23-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3520-30-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4040-19-0x0000000000400000-0x0000000000421000-memory.dmp

Download