remcos | 20fe5347a7254b7f5d75c7fce2542b88abdb8d1939afe621544c61d35e45bdee

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
11/02/2021, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER_73537.exe
Size 1.2MB
Sample210211-ebe633k5jj
SHA256 20fe5347a7254b7f5d75c7fce2542b88abdb8d1939afe621544c61d35e45bdee
MD5 06a71959adabc1b660732bdbb67376bd
SHA1 0858be012d41367e034d1eaf26de337598990c54
SHA512 80665f8b257fc39f911ec2efab1a8efdc82e90ffb8e8a843a27c2e5d28ec9e5b0af826bf7dba63dcf7e73b31354deda054f8e71b28c622d22c6bee32dfecdbf5
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fkeer = "C:\\Users\\Public\\Libraries\\reekF.url"	ORDER_73537.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
268	ieinstal.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31
PID 1044 wrote to memory of 268	1044	ORDER_73537.exe	31

C:\Users\Admin\AppData\Local\Temp\ORDER_73537.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_73537.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-5-0x0000000000090000-0x0000000000091000-memory.dmp

Download

memory/268-7-0x00000000000D0000-0x00000000000D1000-memory.dmp

Download

memory/268-9-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/268-10-0x00000000760A1000-0x00000000760A3000-memory.dmp

Download

memory/268-16-0x0000000000340000-0x00000000003B9000-memory.dmp

Download

memory/268-15-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/1044-2-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1044-3-0x00000000006E0000-0x00000000006FA000-memory.dmp

Download

memory/1536-4-0x000007FEF77C0000-0x000007FEF7A3A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads