remcos | 5e0414eddc6f66f187a13acfc42cd37568af9f904823e0bceebc5c7f451ea80a

Analysis

max time kernel
151s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
16/02/2021, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payment.exe
Size 249KB
Sample210216-naj18ptr3n
SHA256 5e0414eddc6f66f187a13acfc42cd37568af9f904823e0bceebc5c7f451ea80a
MD5 91389828fe5ae5e5a96983826c0eb0d0
SHA1 cd21df962aada5660de39ea828fba2d9b1651041
SHA512 5c141d6764a853ab4236951ec5875425f8d2c052fb4d26841176d29762d7fcebb5ad914ab2ec317100c3a2c4f9be1d5434f6601125f992cc977f39f5faad4aa5
MD5 SHA1 SHA512

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

103.89.88.238:4299

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 2 IoCs

pid	Process
1096	payment.exe
1096	payment.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 2032	1096	payment.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1096	payment.exe
1096	payment.exe
1096	payment.exe
1096	payment.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1096	payment.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	payment.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2032	1096	payment.exe	26
PID 1096 wrote to memory of 2032	1096	payment.exe	26
PID 1096 wrote to memory of 2032	1096	payment.exe	26
PID 1096 wrote to memory of 2032	1096	payment.exe	26
PID 1096 wrote to memory of 2032	1096	payment.exe	26

C:\Users\Admin\AppData\Local\Temp\payment.exe
"C:\Users\Admin\AppData\Local\Temp\payment.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\payment.exe
  "C:\Users\Admin\AppData\Local\Temp\payment.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-2-0x00000000761F1000-0x00000000761F3000-memory.dmp

Download

memory/2032-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download