remcos | b07222849fb4e7b330768782a9f900c3f28ab4de8ea584eef5ff62df9485111d

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
09/02/2021, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation-3276.PDF.exe
Size 243KB
Sample210209-e2jl18m89j
SHA256 b07222849fb4e7b330768782a9f900c3f28ab4de8ea584eef5ff62df9485111d
MD5 0a9209bfce4335e77a68d4482b0ddddc
SHA1 2ac2bae033511f12f2bfd1f54cefe294cea07c50
SHA512 a3cf8d5ecf7924b1e44705cdb0270a8cf6d21c779285476ee9cdb889a154be33980e941f56bf3cfd0ec35492c510251160cef1a272c5dc5dfac6ae647e9eb271
MD5 SHA1 SHA512

Score

10^/10

remcos persistence ransomware rat

Malware Config

Extracted

Family

remcos

cjmoneykelvincrugar.duckdns.org:20944

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 2 IoCs

pid	Process
1732	Quotation-3276.PDF.exe
1732	Quotation-3276.PDF.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\name = "C:\\Users\\Admin\\AppData\\Roaming\\folder\\file.exe"	Quotation-3276.PDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1980	1732	Quotation-3276.PDF.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1732	Quotation-3276.PDF.exe
1732	Quotation-3276.PDF.exe
1732	Quotation-3276.PDF.exe
1732	Quotation-3276.PDF.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1732	Quotation-3276.PDF.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1980	Quotation-3276.PDF.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1980	1732	Quotation-3276.PDF.exe	26
PID 1732 wrote to memory of 1980	1732	Quotation-3276.PDF.exe	26
PID 1732 wrote to memory of 1980	1732	Quotation-3276.PDF.exe	26
PID 1732 wrote to memory of 1980	1732	Quotation-3276.PDF.exe	26
PID 1732 wrote to memory of 1980	1732	Quotation-3276.PDF.exe	26

C:\Users\Admin\AppData\Local\Temp\Quotation-3276.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation-3276.PDF.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\Quotation-3276.PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation-3276.PDF.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-2-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Download

memory/1980-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download