remcos | 5edcaa5dd9d8d6726e02b8bd53b8c8695d781d9c324ac4805da72daf3cf5df0d

Analysis

max time kernel
148s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
05/02/2021, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_409011 documento de recibo,pdf.exe
Size 747KB
Sample210205-9kltgfr8bj
SHA256 5edcaa5dd9d8d6726e02b8bd53b8c8695d781d9c324ac4805da72daf3cf5df0d
MD5 7669f38afc005a2bb5a894bdc35385ca
SHA1 abc475e1f64ba70bdb66c4b38baa461ca7cf30a4
SHA512 a92f6dc6266e234bba3ef8404731141dab5660f4f30e0c30636453f32417e6f8087887468a6f8a97751737e536d001cc4684ca1e364af2763651574700942dc2
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Akcnm = "C:\\Users\\Public\\Libraries\\mnckA.url"	DHL_409011 documento de recibo,pdf.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79
PID 1192 wrote to memory of 2668	1192	DHL_409011 documento de recibo,pdf.exe	79

C:\Users\Admin\AppData\Local\Temp\DHL_409011 documento de recibo,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_409011 documento de recibo,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  PID:2668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-2-0x00000000021B0000-0x00000000021B1000-memory.dmp

Download

memory/2668-5-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/2668-3-0x0000000000B00000-0x0000000000B01000-memory.dmp

Download

memory/2668-7-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/2668-13-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2668-12-0x0000000010590000-0x000000001060D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads