remcos | 7372fe2e6401cdbca755f752e7e8407a8a5fbaf81ca5e692705a9819977dc447

Analysis

max time kernel
149s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
12/02/2021, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PRUEBA DE PAGO.exe
Size 903KB
Sample210212-c89ar6wp12
SHA256 7372fe2e6401cdbca755f752e7e8407a8a5fbaf81ca5e692705a9819977dc447
MD5 24b4ff0d22356bea2942e6b79e27ac4a
SHA1 2e6af48d9468a7b38fb250cde9e28c0a526d008d
SHA512 4b50584339b8eae9a7198df238b98cb9622a20b96fade20a0ef45e8bd329628e521fcb55a8e8305b8f789791c16ce28faef3e303bb5c3e2bd2d9a296bc9d0d5c
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uzzrq = "C:\\Users\\Public\\Libraries\\qrzzU.url"	PRUEBA DE PAGO.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4020	ieinstal.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78
PID 4712 wrote to memory of 4020	4712	PRUEBA DE PAGO.exe	78

C:\Users\Admin\AppData\Local\Temp\PRUEBA DE PAGO.exe
"C:\Users\Admin\AppData\Local\Temp\PRUEBA DE PAGO.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4020-3-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/4020-5-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/4020-7-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/4020-11-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/4020-13-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4712-2-0x0000000002330000-0x0000000002331000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads