remcos | f1e9d6eb71a715e5f47a5c6fa5d03e9c3b871a0e88c91c709ff67ab9311caf4e

General

Target
New_shipment_order#42542526_February.exe
Size 881KB
Sample210226-xfsv75pla6
SHA256 f1e9d6eb71a715e5f47a5c6fa5d03e9c3b871a0e88c91c709ff67ab9311caf4e
MD5 88f82763beb4dd0be4ea6cea7284e556
SHA1 0cdcfa4225242f4e953a3da53376b5639e5be856
SHA512 2dc50f490d6c94247adc4d645ea4b27e201fe85340fbe8d51c622ce4d30ef512db57a8ef7eb0ce9d8bdc791bbfa16a097810d48d89942210bf31b36c8af00e6d
MD5 SHA1 SHA512

Score

10^/10

remcos xmrig miner persistence rat

Malware Config

Extracted

Family

remcos

C2

gustavobillz.duckdns.org:57439
gustavobills.gotdns.ch:57439

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ksapd = "C:\\Users\\Public\\Libraries\\dpasK.url"	New_shipment_order#42542526_February.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfpmp.exe	mfpmp.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	mfpmp.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 3152 wrote to memory of 8	3152	New_shipment_order#42542526_February.exe	78
PID 8 wrote to memory of 1008	8	mfpmp.exe	79
PID 8 wrote to memory of 1008	8	mfpmp.exe	79
PID 8 wrote to memory of 1008	8	mfpmp.exe	79

C:\Users\Admin\AppData\Local\Temp\New_shipment_order#42542526_February.exe
"C:\Users\Admin\AppData\Local\Temp\New_shipment_order#42542526_February.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\mfpmp.exe
  C:\Windows\System32\mfpmp.exe
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sybc.vbs"
    3⤵
    PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-3-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/8-5-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/8-7-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/8-13-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/8-12-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/3152-2-0x0000000000670000-0x0000000000671000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads