remcos | 38ae495598f7ea60de08fbdef9f15051a7be606ce0c532766cddb4d13de6b8e3

General

Target

AKBANK E-DEKONT.exe
Size

530KB
MD5

860767d5cca20c73f2824af9dd531c2c
SHA1

4c2e344e91d2fb6a3cb192c751c2f73961408c29
SHA256

38ae495598f7ea60de08fbdef9f15051a7be606ce0c532766cddb4d13de6b8e3
SHA512

8996f266d8755a6106816a06d25ded34596e62fc71d7d65af7cd10b8b3d7e4c0e2eb2f7bb46d256fa57023d7fed6ae81f5c2c0bab011c83fddcffe50ae16cc50

Score

10^/10

remcos ransomware rat

Malware Config

Extracted

Family

remcos

C2

45.137.22.52:8780

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082
Suspicious use of SetThreadContext 1 IoCs

Processes:

AKBANK E-DEKONT.exe

description pid process target process

PID 3864 set thread context of 2580 3864 AKBANK E-DEKONT.exe AKBANK E-DEKONT.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4040 schtasks.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

AKBANK E-DEKONT.exeAKBANK E-DEKONT.exe

pid process

412 AKBANK E-DEKONT.exe
3864 AKBANK E-DEKONT.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AKBANK E-DEKONT.exe

pid process

2580 AKBANK E-DEKONT.exe

description	pid	process	target process
PID 3864 set thread context of 2580	3864	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe

pid	process
4040	schtasks.exe

pid	process
412	AKBANK E-DEKONT.exe
3864	AKBANK E-DEKONT.exe

pid	process
2580	AKBANK E-DEKONT.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

AKBANK E-DEKONT.execmd.exeAKBANK E-DEKONT.exe

description	pid	process	target process
PID 412 wrote to memory of 732	412	AKBANK E-DEKONT.exe	cmd.exe
PID 412 wrote to memory of 732	412	AKBANK E-DEKONT.exe	cmd.exe
PID 412 wrote to memory of 732	412	AKBANK E-DEKONT.exe	cmd.exe
PID 412 wrote to memory of 3884	412	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe
PID 412 wrote to memory of 3884	412	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe
PID 412 wrote to memory of 3884	412	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe
PID 412 wrote to memory of 3864	412	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe
PID 412 wrote to memory of 3864	412	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe
PID 412 wrote to memory of 3864	412	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe
PID 732 wrote to memory of 4040	732	cmd.exe	schtasks.exe
PID 732 wrote to memory of 4040	732	cmd.exe	schtasks.exe
PID 732 wrote to memory of 4040	732	cmd.exe	schtasks.exe
PID 3864 wrote to memory of 2580	3864	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe
PID 3864 wrote to memory of 2580	3864	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe
PID 3864 wrote to memory of 2580	3864	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe
PID 3864 wrote to memory of 2580	3864	AKBANK E-DEKONT.exe	AKBANK E-DEKONT.exe

C:\Users\Admin\AppData\Local\Temp\AKBANK E-DEKONT.exe
"C:\Users\Admin\AppData\Local\Temp\AKBANK E-DEKONT.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\9cd7b568038d4e42bada35180882d9f0.xml"
2⤵
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\9cd7b568038d4e42bada35180882d9f0.xml"
3⤵
- Creates scheduled task(s)
PID:4040

C:\Users\Admin\AppData\Local\Temp\AKBANK E-DEKONT.exe
"C:\Users\Admin\AppData\Local\Temp\AKBANK E-DEKONT.exe"
2⤵
PID:3884

C:\Users\Admin\AppData\Local\Temp\AKBANK E-DEKONT.exe
"C:\Users\Admin\AppData\Local\Temp\AKBANK E-DEKONT.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3864

C:\Users\Admin\AppData\Local\Temp\AKBANK E-DEKONT.exe
"C:\Users\Admin\AppData\Local\Temp\AKBANK E-DEKONT.exe"
3⤵
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9cd7b568038d4e42bada35180882d9f0.xml
MD5
a36564afc14b3eb0849c01a3afdb9944

SHA1
4dcee9fae3fde4e46b08529bc0ba067150686f07

SHA256
9d4342f763c5d62a06f69aa6fdcb1caa376ff2f2c0972f36b487f73b4d221996

SHA512
782082aa36ae056734e90fc079c813dfef59420571a1b70cde4cf15eb6c870f85b2bfe0748ef4db9df3d010c08671bff744d78178ba75bf2ba02b665f044ae89

Download Submit
memory/732-2-0x0000000000000000-mapping.dmp

Download
memory/2580-6-0x000000000040FD88-mapping.dmp

Download
memory/2580-7-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3864-3-0x0000000000000000-mapping.dmp

Download
memory/4040-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads