remcos | dfd3c33bf7be405cea03a045f3df2d9ff35f04c7da918eb916b6f224a58eea1f

General

Target
QUOTATION 19 01 2021.exe
Size 862KB
Sample210119-v87jgbxvj2
SHA256 dfd3c33bf7be405cea03a045f3df2d9ff35f04c7da918eb916b6f224a58eea1f
MD5 1ae02a184e418f3791bdf8c969fcbf99
SHA1 15714713cf688f8d1b70a35915beeba2c4525f49
SHA512 ab597ddd54faee1a91f16801297363f99881d3d6a7d72bd4259b504644393dcac43467daff7ef97de987308dedfa13b0a68c399fd0849d2e9dabf350930a1968
MD5 SHA1 SHA512

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

87.237.165.162:1011

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4060 set thread context of 4088	4060	QUOTATION 19 01 2021.exe	80

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3620	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4088	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 3620	4060	QUOTATION 19 01 2021.exe	78
PID 4060 wrote to memory of 3620	4060	QUOTATION 19 01 2021.exe	78
PID 4060 wrote to memory of 3620	4060	QUOTATION 19 01 2021.exe	78
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80
PID 4060 wrote to memory of 4088	4060	QUOTATION 19 01 2021.exe	80

C:\Users\Admin\AppData\Local\Temp\QUOTATION 19 01 2021.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION 19 01 2021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cqxZBWZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1185.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4060-9-0x0000000005180000-0x0000000005181000-memory.dmp

Download

memory/4060-6-0x0000000005480000-0x0000000005481000-memory.dmp

Download

memory/4060-7-0x0000000004F80000-0x0000000004F81000-memory.dmp

Download

memory/4060-8-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download

memory/4060-2-0x00000000733D0000-0x0000000073ABE000-memory.dmp

Download

memory/4060-10-0x00000000050E0000-0x0000000005103000-memory.dmp

Download

memory/4060-11-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/4060-12-0x0000000005C40000-0x0000000005C99000-memory.dmp

Download

memory/4060-5-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Download

memory/4060-3-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/4088-15-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4088-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads