remcos | 0bfae38c37f8478cfd4c92f603b202f8f4bff11f96fdce5959eeaad5142d9a3a

General

Target

POEA DELISTED AGENCIES (BATCH A).PDF.exe
Size

515KB
MD5

217179aac1ed3994614e7c8666d2f82b
SHA1

d62998531aea7d6acb9d0add1f168739e2e9eab1
SHA256

0bfae38c37f8478cfd4c92f603b202f8f4bff11f96fdce5959eeaad5142d9a3a
SHA512

fd70c49c0fb1df2606e2496497656a4d23ab9868b227a1fef62ff4fa321952964bcd64f70bad1b1a8d763f4985264f1edd6ff19f0b6441bf214f2a37363179ce

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

shahzad73.casacam.net:2404

shahzad73.ddns.net:2404

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
428	POEA DELISTED AGENCIES (BATCH A).PDF.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4056	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	78
PID 4704 wrote to memory of 4056	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	78
PID 4704 wrote to memory of 4056	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	78
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80
PID 4704 wrote to memory of 428	4704	POEA DELISTED AGENCIES (BATCH A).PDF.exe	80

C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe
"C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iUReni" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBFCB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe
  "{path}"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/428-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/428-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4704-6-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/4704-9-0x0000000008130000-0x0000000008131000-memory.dmp

Filesize
4KB

Download
memory/4704-10-0x00000000080F0000-0x00000000080FB000-memory.dmp

Filesize
44KB

Download
memory/4704-11-0x00000000081D0000-0x0000000008246000-memory.dmp

Filesize
472KB

Download
memory/4704-8-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/4704-7-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/4704-2-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download
memory/4704-5-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/4704-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads