remcos

General

Target
QUOTATION PDF_SCAN_COPY.exe
Size 198KB
Sample210208-x22bb3mhcn
SHA256 d968f2f9d3fc7604d16be3fdf8e4367f5ced695eb0c3706fecf04f7754c5cd5d
MD5 8a3988d453cdc5d5125497c2cd40c320
SHA1 3a1f1b4f143c01728b87c144cbd5b0b85e5bcf90
SHA512 a572030c09b45cc975b5e093f6024094e54ded156da3773ab0911b1553b784c2499348499599ac64452e1e13963ed8f9963b17b359929272839187a021bd230e
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

C2

eileenwmsscm.duckdns.org:2558

Targets

- Target
  QUOTATION PDF_SCAN_COPY.exe
- Size 198KB
- SHA256 d968f2f9d3fc7604d16be3fdf8e4367f5ced695eb0c3706fecf04f7754c5cd5d
- MD5 8a3988d453cdc5d5125497c2cd40c320
- SHA1 3a1f1b4f143c01728b87c144cbd5b0b85e5bcf90
- SHA512 a572030c09b45cc975b5e093f6024094e54ded156da3773ab0911b1553b784c2499348499599ac64452e1e13963ed8f9963b17b359929272839187a021bd230e
- MD5 SHA1 SHA512
Score

10^/10

remcos persistence ransomware rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates physical storage devices
  Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2