remcos | 0bfae38c37f8478cfd4c92f603b202f8f4bff11f96fdce5959eeaad5142d9a3a

General

Target

POEA DELISTED AGENCIES (BATCH A).PDF.exe
Size

515KB
MD5

217179aac1ed3994614e7c8666d2f82b
SHA1

d62998531aea7d6acb9d0add1f168739e2e9eab1
SHA256

0bfae38c37f8478cfd4c92f603b202f8f4bff11f96fdce5959eeaad5142d9a3a
SHA512

fd70c49c0fb1df2606e2496497656a4d23ab9868b227a1fef62ff4fa321952964bcd64f70bad1b1a8d763f4985264f1edd6ff19f0b6441bf214f2a37363179ce

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

shahzad73.casacam.net:2404

shahzad73.ddns.net:2404

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

POEA DELISTED AGENCIES (BATCH A).PDF.exe

description	pid	process	target process
PID 4704 set thread context of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4056 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

POEA DELISTED AGENCIES (BATCH A).PDF.exe

pid process

4704 POEA DELISTED AGENCIES (BATCH A).PDF.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

POEA DELISTED AGENCIES (BATCH A).PDF.exe

description pid process

Token: SeDebugPrivilege 4704 POEA DELISTED AGENCIES (BATCH A).PDF.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

POEA DELISTED AGENCIES (BATCH A).PDF.exe

pid process

428 POEA DELISTED AGENCIES (BATCH A).PDF.exe

pid	process
4056	schtasks.exe

pid	process
4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe

description	pid	process
Token: SeDebugPrivilege	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe

pid	process
428	POEA DELISTED AGENCIES (BATCH A).PDF.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

POEA DELISTED AGENCIES (BATCH A).PDF.exe

description	pid	process	target process
PID 4704 wrote to memory of 4056	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	schtasks.exe
PID 4704 wrote to memory of 4056	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	schtasks.exe
PID 4704 wrote to memory of 4056	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	schtasks.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	POEA DELISTED AGENCIES (BATCH A).PDF.exe

C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe
"C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iUReni" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBFCB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe
  "{path}"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBFCB.tmp

MD5
ce663c0d80864fb676dbf68f59b159bb

SHA1
66342c1b7b0411726f65a73c0fa6f35d8c97dd83

SHA256
a6de060e5d4f9bfdec02081341e3ffd53a5182b24c5520db4616ff48ed0dd869

SHA512
a02abad55987db2e28c4ea32a2d251e6c8d61674654f3956ba8537f792d3344ca4b9786202d0bd9d02a1bab966890cc97a94a7649803f381ee3fd588d4753bb5

Download Submit
memory/428-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/428-15-0x0000000000413FA4-mapping.dmp

Download
memory/428-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4056-12-0x0000000000000000-mapping.dmp

Download
memory/4704-6-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/4704-9-0x0000000008130000-0x0000000008131000-memory.dmp

Filesize
4KB

Download
memory/4704-10-0x00000000080F0000-0x00000000080FB000-memory.dmp

Filesize
44KB

Download
memory/4704-11-0x00000000081D0000-0x0000000008246000-memory.dmp

Filesize
472KB

Download
memory/4704-8-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/4704-7-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/4704-2-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download
memory/4704-5-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/4704-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads