remcos | 69dcf72c5f8c1751c5b144899cd43d26c7a639748d4b9a6de53bd4e3a492da3b

General

Target

SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
Size

1.3MB
MD5

80f76c27257e6f3e7566b9ef3ea79503
SHA1

17fd209d1ab414da48dae8f2a5b83a435d2ecb21
SHA256

69dcf72c5f8c1751c5b144899cd43d26c7a639748d4b9a6de53bd4e3a492da3b
SHA512

801a4fc0c77a8efe7ca72eadd49ba8a449f8ff3112b114eba282f26bab55990d54bcf0ade39d195d60def9d791b16b2c90e6d9c4c56ba994a0f0d77abb718f4b

Score

10^/10

remcos persistence ransomware rat

Malware Config

Extracted

Family

remcos

C2

hjduiebcvzcalpmjdbcnwqadhsiybcnzxswedgap.ydns.eu:2024

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

win.exewin.exe

pid process

1552 win.exe
792 win.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

924 cmd.exe
924 cmd.exe

pid	process
1552	win.exe
792	win.exe

pid	process
924	cmd.exe
924	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

win.exeSecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\""	win.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\""	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	win.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

Processes:

SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exewin.exe

pid	process
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
1552	win.exe
1552	win.exe
1552	win.exe
1552	win.exe
1552	win.exe
1552	win.exe
1552	win.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exewin.exe

description	pid	process	target process
PID 740 set thread context of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 1552 set thread context of 792	1552	win.exe	win.exe

Delays execution with timeout.exe 6 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

1708 timeout.exe
1584 timeout.exe
1700 timeout.exe
1212 timeout.exe
912 timeout.exe
1748 timeout.exe

pid	process
1708	timeout.exe
1584	timeout.exe
1700	timeout.exe
1212	timeout.exe
912	timeout.exe
1748	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exewin.exe

pid	process
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
1552	win.exe
1552	win.exe
1552	win.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exewin.exe

description pid process

Token: SeDebugPrivilege 740 SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
Token: SeDebugPrivilege 1552 win.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

win.exe

pid process

792 win.exe

description	pid	process
Token: SeDebugPrivilege	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
Token: SeDebugPrivilege	1552	win.exe

pid	process
792	win.exe

Suspicious use of WriteProcessMemory 82 IoCs

Processes:

SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.execmd.execmd.execmd.exeSecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exeWScript.execmd.exewin.execmd.execmd.exe

description	pid	process	target process
PID 740 wrote to memory of 1340	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 740 wrote to memory of 1340	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 740 wrote to memory of 1340	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 740 wrote to memory of 1340	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 1340 wrote to memory of 912	1340	cmd.exe	timeout.exe
PID 1340 wrote to memory of 912	1340	cmd.exe	timeout.exe
PID 1340 wrote to memory of 912	1340	cmd.exe	timeout.exe
PID 1340 wrote to memory of 912	1340	cmd.exe	timeout.exe
PID 740 wrote to memory of 316	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 740 wrote to memory of 316	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 740 wrote to memory of 316	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 740 wrote to memory of 316	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 316 wrote to memory of 1748	316	cmd.exe	timeout.exe
PID 316 wrote to memory of 1748	316	cmd.exe	timeout.exe
PID 316 wrote to memory of 1748	316	cmd.exe	timeout.exe
PID 316 wrote to memory of 1748	316	cmd.exe	timeout.exe
PID 740 wrote to memory of 1744	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 740 wrote to memory of 1744	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 740 wrote to memory of 1744	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 740 wrote to memory of 1744	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	cmd.exe
PID 1744 wrote to memory of 1708	1744	cmd.exe	timeout.exe
PID 1744 wrote to memory of 1708	1744	cmd.exe	timeout.exe
PID 1744 wrote to memory of 1708	1744	cmd.exe	timeout.exe
PID 1744 wrote to memory of 1708	1744	cmd.exe	timeout.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 740 wrote to memory of 392	740	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
PID 392 wrote to memory of 576	392	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	WScript.exe
PID 392 wrote to memory of 576	392	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	WScript.exe
PID 392 wrote to memory of 576	392	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	WScript.exe
PID 392 wrote to memory of 576	392	SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe	WScript.exe
PID 576 wrote to memory of 924	576	WScript.exe	cmd.exe
PID 576 wrote to memory of 924	576	WScript.exe	cmd.exe
PID 576 wrote to memory of 924	576	WScript.exe	cmd.exe
PID 576 wrote to memory of 924	576	WScript.exe	cmd.exe
PID 924 wrote to memory of 1552	924	cmd.exe	win.exe
PID 924 wrote to memory of 1552	924	cmd.exe	win.exe
PID 924 wrote to memory of 1552	924	cmd.exe	win.exe
PID 924 wrote to memory of 1552	924	cmd.exe	win.exe
PID 1552 wrote to memory of 680	1552	win.exe	cmd.exe
PID 1552 wrote to memory of 680	1552	win.exe	cmd.exe
PID 1552 wrote to memory of 680	1552	win.exe	cmd.exe
PID 1552 wrote to memory of 680	1552	win.exe	cmd.exe
PID 680 wrote to memory of 1584	680	cmd.exe	timeout.exe
PID 680 wrote to memory of 1584	680	cmd.exe	timeout.exe
PID 680 wrote to memory of 1584	680	cmd.exe	timeout.exe
PID 680 wrote to memory of 1584	680	cmd.exe	timeout.exe
PID 1552 wrote to memory of 1716	1552	win.exe	cmd.exe
PID 1552 wrote to memory of 1716	1552	win.exe	cmd.exe
PID 1552 wrote to memory of 1716	1552	win.exe	cmd.exe
PID 1552 wrote to memory of 1716	1552	win.exe	cmd.exe
PID 1716 wrote to memory of 1700	1716	cmd.exe	timeout.exe
PID 1716 wrote to memory of 1700	1716	cmd.exe	timeout.exe
PID 1716 wrote to memory of 1700	1716	cmd.exe	timeout.exe
PID 1716 wrote to memory of 1700	1716	cmd.exe	timeout.exe
PID 1552 wrote to memory of 712	1552	win.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:912

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1708

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.80f76c27257e6f3e.8558.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\win.exe"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:924

C:\Users\Admin\AppData\Roaming\win.exe
C:\Users\Admin\AppData\Roaming\win.exe
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
6⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\timeout.exe
timeout 1
7⤵
- Delays execution with timeout.exe
PID:1584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
6⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\timeout.exe
timeout 1
7⤵
- Delays execution with timeout.exe
PID:1700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
6⤵
PID:712

C:\Windows\SysWOW64\timeout.exe
timeout 1
7⤵
- Delays execution with timeout.exe
PID:1212

C:\Users\Admin\AppData\Roaming\win.exe
"C:\Users\Admin\AppData\Roaming\win.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
4a74e626596d6e66b4bbc59ee6848f2d

SHA1
047849ac8735ecc0943428c7cd5e00b52eee06ed

SHA256
98bd6dc219a7a3e04d3d67bbec9f0b4d4640831a3a6be0a0078b050041088b0e

SHA512
1cd943482d0f1ce2ffaf6ee4a82895e4d57c52051bb14bbda0548cf072b4c5cbe719d2cdb549b5ae7c0241dd9c68dd9d1674acd26aed684b8145500079cc5403

Download Submit
C:\Users\Admin\AppData\Roaming\win.exe
MD5
80f76c27257e6f3e7566b9ef3ea79503

SHA1
17fd209d1ab414da48dae8f2a5b83a435d2ecb21

SHA256
69dcf72c5f8c1751c5b144899cd43d26c7a639748d4b9a6de53bd4e3a492da3b

SHA512
801a4fc0c77a8efe7ca72eadd49ba8a449f8ff3112b114eba282f26bab55990d54bcf0ade39d195d60def9d791b16b2c90e6d9c4c56ba994a0f0d77abb718f4b

Download Submit
C:\Users\Admin\AppData\Roaming\win.exe
MD5
80f76c27257e6f3e7566b9ef3ea79503

SHA1
17fd209d1ab414da48dae8f2a5b83a435d2ecb21

SHA256
69dcf72c5f8c1751c5b144899cd43d26c7a639748d4b9a6de53bd4e3a492da3b

SHA512
801a4fc0c77a8efe7ca72eadd49ba8a449f8ff3112b114eba282f26bab55990d54bcf0ade39d195d60def9d791b16b2c90e6d9c4c56ba994a0f0d77abb718f4b

Download Submit
C:\Users\Admin\AppData\Roaming\win.exe
MD5
80f76c27257e6f3e7566b9ef3ea79503

SHA1
17fd209d1ab414da48dae8f2a5b83a435d2ecb21

SHA256
69dcf72c5f8c1751c5b144899cd43d26c7a639748d4b9a6de53bd4e3a492da3b

SHA512
801a4fc0c77a8efe7ca72eadd49ba8a449f8ff3112b114eba282f26bab55990d54bcf0ade39d195d60def9d791b16b2c90e6d9c4c56ba994a0f0d77abb718f4b

Download Submit
\Users\Admin\AppData\Roaming\win.exe
MD5
80f76c27257e6f3e7566b9ef3ea79503

SHA1
17fd209d1ab414da48dae8f2a5b83a435d2ecb21

SHA256
69dcf72c5f8c1751c5b144899cd43d26c7a639748d4b9a6de53bd4e3a492da3b

SHA512
801a4fc0c77a8efe7ca72eadd49ba8a449f8ff3112b114eba282f26bab55990d54bcf0ade39d195d60def9d791b16b2c90e6d9c4c56ba994a0f0d77abb718f4b

Download Submit
\Users\Admin\AppData\Roaming\win.exe
MD5
80f76c27257e6f3e7566b9ef3ea79503

SHA1
17fd209d1ab414da48dae8f2a5b83a435d2ecb21

SHA256
69dcf72c5f8c1751c5b144899cd43d26c7a639748d4b9a6de53bd4e3a492da3b

SHA512
801a4fc0c77a8efe7ca72eadd49ba8a449f8ff3112b114eba282f26bab55990d54bcf0ade39d195d60def9d791b16b2c90e6d9c4c56ba994a0f0d77abb718f4b

Download Submit
memory/316-9-0x0000000000000000-mapping.dmp

Download
memory/392-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/392-14-0x0000000000413FA4-mapping.dmp

Download
memory/392-15-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/392-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/576-21-0x00000000025A0000-0x00000000025A4000-memory.dmp

Filesize
16KB

Download
memory/576-16-0x0000000000000000-mapping.dmp

Download
memory/680-31-0x0000000000000000-mapping.dmp

Download
memory/712-36-0x0000000000000000-mapping.dmp

Download
memory/740-6-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/740-5-0x0000000000660000-0x000000000068F000-memory.dmp

Filesize
188KB

Download
memory/740-3-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/740-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/792-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/792-39-0x0000000000413FA4-mapping.dmp

Download
memory/912-8-0x0000000000000000-mapping.dmp

Download
memory/924-20-0x0000000000000000-mapping.dmp

Download
memory/1212-37-0x0000000000000000-mapping.dmp

Download
memory/1340-7-0x0000000000000000-mapping.dmp

Download
memory/1552-28-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/1552-33-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/1552-27-0x00000000732D0000-0x00000000739BE000-memory.dmp

Filesize
6.9MB

Download
memory/1552-25-0x0000000000000000-mapping.dmp

Download
memory/1584-32-0x0000000000000000-mapping.dmp

Download
memory/1700-35-0x0000000000000000-mapping.dmp

Download
memory/1708-12-0x0000000000000000-mapping.dmp

Download
memory/1716-34-0x0000000000000000-mapping.dmp

Download
memory/1744-11-0x0000000000000000-mapping.dmp

Download
memory/1748-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads