remcos | 71f60a985d2cc9fc47c6845a88eea4da19303a96a2ff69daae70276f70dcdae0

Analysis

max time kernel
148s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
18/02/2021, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nrfgylra.exe
Size 976KB
Sample210218-d74wjy4kls
SHA256 71f60a985d2cc9fc47c6845a88eea4da19303a96a2ff69daae70276f70dcdae0
MD5 c2899c3f889c918413f0b455748a754a
SHA1 8903727d4ded62f1ab9375fb0f55393923b1e4ab
SHA512 b781bbc3bbcabcbc17600994a8f612cfdb822088f4c73cb8223226aab8d673798c1b372c9d544d37c47247a7999d6014ed0096921461fe878746e6a0b2ede704
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nrfgy = "C:\\Users\\Public\\Libraries\\ygfrN.url"	Nrfgylra.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1528	ieinstal.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78
PID 652 wrote to memory of 1528	652	Nrfgylra.exe	78

C:\Users\Admin\AppData\Local\Temp\Nrfgylra.exe
"C:\Users\Admin\AppData\Local\Temp\Nrfgylra.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:652
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-2-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/1528-3-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Download

memory/1528-5-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Download

memory/1528-7-0x0000000003210000-0x0000000003211000-memory.dmp

Download

memory/1528-11-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/1528-13-0x0000000000400000-0x0000000000479000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads