remcos | 20fe5347a7254b7f5d75c7fce2542b88abdb8d1939afe621544c61d35e45bdee

Analysis

max time kernel
149s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
11/02/2021, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER_73537.exe
Size 1.2MB
Sample210211-ebe633k5jj
SHA256 20fe5347a7254b7f5d75c7fce2542b88abdb8d1939afe621544c61d35e45bdee
MD5 06a71959adabc1b660732bdbb67376bd
SHA1 0858be012d41367e034d1eaf26de337598990c54
SHA512 80665f8b257fc39f911ec2efab1a8efdc82e90ffb8e8a843a27c2e5d28ec9e5b0af826bf7dba63dcf7e73b31354deda054f8e71b28c622d22c6bee32dfecdbf5
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fkeer = "C:\\Users\\Public\\Libraries\\reekF.url"	ORDER_73537.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3180	ieinstal.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78
PID 4704 wrote to memory of 3180	4704	ORDER_73537.exe	78

C:\Users\Admin\AppData\Local\Temp\ORDER_73537.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_73537.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3180-3-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Download

memory/3180-5-0x0000000003540000-0x0000000003541000-memory.dmp

Download

memory/3180-7-0x0000000003210000-0x0000000003211000-memory.dmp

Download

memory/3180-13-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3180-12-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/4704-2-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads