remcos | 0961867a9b02bc083ea6bfebbfe22f2c65df60e429ff34b48f1a16c1dbd6c8fc

General

Target
Orderoffer.exe
Size 723KB
Sample210223-6ttj8w2amn
SHA256 0961867a9b02bc083ea6bfebbfe22f2c65df60e429ff34b48f1a16c1dbd6c8fc
MD5 a81fd71004ff7f2b4bb903511741bf1d
SHA1 0957d41608642b282c9d3b2ebca2e6f3cd8a10c3
SHA512 3ef072d451d5071781068d45304e5dae3d5672d66783ab0096b36466509bd6e6fc649210ad43026ef2971456720305dce0e002d16f5acbef7be1ddf714ca2360
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

bunkman212.ddns.net:2404

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
196	remcos.exe
1504	remcos.exe

Loads dropped DLL 4 IoCs

pid	Process
3888	Orderoffer.exe
3888	Orderoffer.exe
196	remcos.exe
196	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Orderoffer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	Orderoffer.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3888 set thread context of 1772	3888	Orderoffer.exe	75
PID 196 set thread context of 1504	196	remcos.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral2/files/0x000100000001ab73-10.dat	nsis_installer_1
behavioral2/files/0x000100000001ab73-10.dat	nsis_installer_2
behavioral2/files/0x000100000001ab73-11.dat	nsis_installer_1
behavioral2/files/0x000100000001ab73-11.dat	nsis_installer_2
behavioral2/files/0x000100000001ab73-17.dat	nsis_installer_1
behavioral2/files/0x000100000001ab73-17.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	Orderoffer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3888	Orderoffer.exe
3888	Orderoffer.exe
3888	Orderoffer.exe
3888	Orderoffer.exe
3888	Orderoffer.exe
3888	Orderoffer.exe
3888	Orderoffer.exe
3888	Orderoffer.exe
196	remcos.exe
196	remcos.exe
196	remcos.exe
196	remcos.exe
196	remcos.exe
196	remcos.exe
196	remcos.exe
196	remcos.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1504	remcos.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3888	Orderoffer.exe
196	remcos.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1504	remcos.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1504	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1504	remcos.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 1772	3888	Orderoffer.exe	75
PID 3888 wrote to memory of 1772	3888	Orderoffer.exe	75
PID 3888 wrote to memory of 1772	3888	Orderoffer.exe	75
PID 3888 wrote to memory of 1772	3888	Orderoffer.exe	75
PID 1772 wrote to memory of 2528	1772	Orderoffer.exe	76
PID 1772 wrote to memory of 2528	1772	Orderoffer.exe	76
PID 1772 wrote to memory of 2528	1772	Orderoffer.exe	76
PID 2528 wrote to memory of 3952	2528	WScript.exe	78
PID 2528 wrote to memory of 3952	2528	WScript.exe	78
PID 2528 wrote to memory of 3952	2528	WScript.exe	78
PID 3952 wrote to memory of 196	3952	cmd.exe	80
PID 3952 wrote to memory of 196	3952	cmd.exe	80
PID 3952 wrote to memory of 196	3952	cmd.exe	80
PID 196 wrote to memory of 1504	196	remcos.exe	81
PID 196 wrote to memory of 1504	196	remcos.exe	81
PID 196 wrote to memory of 1504	196	remcos.exe	81
PID 196 wrote to memory of 1504	196	remcos.exe	81

C:\Users\Admin\AppData\Local\Temp\Orderoffer.exe
"C:\Users\Admin\AppData\Local\Temp\Orderoffer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Local\Temp\Orderoffer.exe
  "C:\Users\Admin\AppData\Local\Temp\Orderoffer.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:196
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-18-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1772-6-0x0000000000400000-0x0000000000478000-memory.dmp