remcos | 926da3334135961ff0c19ecf4358201ba4734ab01186061c423deeb081ec1cff

Analysis

max time kernel
148s
max time network
140s
platform
windows7_x64
resource
win7v20201028
submitted
09/02/2021, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER_6353745.exe
Size 936KB
Sample210209-3bbwphda46
SHA256 926da3334135961ff0c19ecf4358201ba4734ab01186061c423deeb081ec1cff
MD5 4e00a5d42245a24a24d8e7dc07257b81
SHA1 e3104b4647c8d7f7f51aefd8128f353af42884e0
SHA512 871138cf34401ed6d4aa4c775c64c2cd97f97b6ed5824e9c479de61be94f5cdd28be70ac376d774eb5beb7b6e917932c091092e9af3434655b11f8dfa2ce97d3
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rwulu = "C:\\Users\\Public\\Libraries\\uluwR.url"	ORDER_6353745.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1312	ieinstal.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31
PID 1068 wrote to memory of 1312	1068	ORDER_6353745.exe	31

C:\Users\Admin\AppData\Local\Temp\ORDER_6353745.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_6353745.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-3-0x000007FEF6500000-0x000007FEF677A000-memory.dmp

Download

memory/1068-2-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/1312-4-0x0000000000090000-0x0000000000091000-memory.dmp

Download

memory/1312-6-0x00000000000D0000-0x00000000000D1000-memory.dmp

Download

memory/1312-8-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1312-9-0x00000000756C1000-0x00000000756C3000-memory.dmp

Download

memory/1312-14-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/1312-15-0x0000000000240000-0x00000000002B9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads