remcos | d5a4fddad0c97443d8ddfd4d0531fa43d7060b4601010dda2be37d93f71e9a9b

General

Target
sample.exe
Size 374KB
Sample210202-hdykrraxbe
SHA256 d5a4fddad0c97443d8ddfd4d0531fa43d7060b4601010dda2be37d93f71e9a9b
MD5 91038dd4fca7ba32b6a4d8cca701c595
SHA1 06b64b5a72cd4ae2435ff64c2ff893592ea6afb6
SHA512 cdf9b412a6a504ba6b6324208c072418a041c5323d47057bdf40bb25b345bc1ba72a5e5d7f051e495cc7aff34dc9b322788ea52efa50ffd625dc2c2bb98fa7b4
MD5 SHA1 SHA512

Score

10^/10

remcos persistence ransomware rat

Malware Config

Extracted

Family

remcos

C2

que.hopto.org:2404

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2300	safe.exe
2772	safe.exe

Loads dropped DLL 4 IoCs

pid	Process
3940	sample.exe
3940	sample.exe
2300	safe.exe
2300	safe.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\name = "C:\\Users\\Admin\\AppData\\Roaming\\folder\\file.exe"	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\safe.exe\""	sample.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	safe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\safe.exe\""	safe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3940 set thread context of 2552	3940	sample.exe	75
PID 2300 set thread context of 2772	2300	safe.exe	80

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral2/files/0x000100000001ab6a-10.dat	nsis_installer_1
behavioral2/files/0x000100000001ab6a-10.dat	nsis_installer_2
behavioral2/files/0x000100000001ab6a-11.dat	nsis_installer_1
behavioral2/files/0x000100000001ab6a-11.dat	nsis_installer_2
behavioral2/files/0x000100000001ab6a-20.dat	nsis_installer_1
behavioral2/files/0x000100000001ab6a-20.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	sample.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3940	sample.exe
3940	sample.exe
3940	sample.exe
3940	sample.exe
3940	sample.exe
3940	sample.exe
3940	sample.exe
3940	sample.exe
2300	safe.exe
2300	safe.exe
2300	safe.exe
2300	safe.exe
2300	safe.exe
2300	safe.exe
2300	safe.exe
2300	safe.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3940	sample.exe
2300	safe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	safe.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2552	3940	sample.exe	75
PID 3940 wrote to memory of 2552	3940	sample.exe	75
PID 3940 wrote to memory of 2552	3940	sample.exe	75
PID 3940 wrote to memory of 2552	3940	sample.exe	75
PID 2552 wrote to memory of 3484	2552	sample.exe	76
PID 2552 wrote to memory of 3484	2552	sample.exe	76
PID 2552 wrote to memory of 3484	2552	sample.exe	76
PID 3484 wrote to memory of 2692	3484	WScript.exe	77
PID 3484 wrote to memory of 2692	3484	WScript.exe	77
PID 3484 wrote to memory of 2692	3484	WScript.exe	77
PID 2692 wrote to memory of 2300	2692	cmd.exe	79
PID 2692 wrote to memory of 2300	2692	cmd.exe	79
PID 2692 wrote to memory of 2300	2692	cmd.exe	79
PID 2300 wrote to memory of 2772	2300	safe.exe	80
PID 2300 wrote to memory of 2772	2300	safe.exe	80
PID 2300 wrote to memory of 2772	2300	safe.exe	80
PID 2300 wrote to memory of 2772	2300	safe.exe	80

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\sample.exe
  "C:\Users\Admin\AppData\Local\Temp\sample.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\safe.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Users\Admin\AppData\Roaming\Remcos\safe.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\safe.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2300
      - C:\Users\Admin\AppData\Roaming\Remcos\safe.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\safe.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:2772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-5-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2772-21-0x0000000000400000-0x0000000000421000-memory.dmp