remcos | 926da3334135961ff0c19ecf4358201ba4734ab01186061c423deeb081ec1cff

Analysis

max time kernel
150s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
09/02/2021, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER_6353745.exe
Size 936KB
Sample210209-3bbwphda46
SHA256 926da3334135961ff0c19ecf4358201ba4734ab01186061c423deeb081ec1cff
MD5 4e00a5d42245a24a24d8e7dc07257b81
SHA1 e3104b4647c8d7f7f51aefd8128f353af42884e0
SHA512 871138cf34401ed6d4aa4c775c64c2cd97f97b6ed5824e9c479de61be94f5cdd28be70ac376d774eb5beb7b6e917932c091092e9af3434655b11f8dfa2ce97d3
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rwulu = "C:\\Users\\Public\\Libraries\\uluwR.url"	ORDER_6353745.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	ieinstal.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79
PID 1048 wrote to memory of 1924	1048	ORDER_6353745.exe	79

C:\Users\Admin\AppData\Local\Temp\ORDER_6353745.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_6353745.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-2-0x0000000002320000-0x0000000002321000-memory.dmp

Download

memory/1924-3-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/1924-5-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/1924-7-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/1924-11-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/1924-13-0x0000000000BA0000-0x0000000000C19000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads