remcos | 86eb335425ab87285d7fc03826498925262e64a466fac29d22c8ae1a806feaae

Analysis

max time kernel
148s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
28/02/2021, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paid Invoice _confirmation_9336639_03993736553.exe
Size 1.1MB
Sample210228-n4sr2ceaxa
SHA256 86eb335425ab87285d7fc03826498925262e64a466fac29d22c8ae1a806feaae
MD5 42d277a9217eb92923e54b3d1adea3ac
SHA1 c30ffde08bc8abf1e4c117e5901f7895493ebbaf
SHA512 aef659224173cf1ac1a039284f4ed6ad589bfa32c790bb0c116b28a8644e6e730f5afed3b5db2f61428624098acb2af2fd89faf0e6d97c897faebbbc07661be9
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

216.38.7.225:6809

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cfngj = "C:\\Users\\Public\\Libraries\\jgnfC.url"	Paid Invoice _confirmation_9336639_03993736553.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79
PID 1908 wrote to memory of 2140	1908	Paid Invoice _confirmation_9336639_03993736553.exe	79

C:\Users\Admin\AppData\Local\Temp\Paid Invoice _confirmation_9336639_03993736553.exe
"C:\Users\Admin\AppData\Local\Temp\Paid Invoice _confirmation_9336639_03993736553.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\sethc.exe
  C:\Windows\System32\sethc.exe
  2⤵
  PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-2-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/2140-3-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/2140-5-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/2140-7-0x0000000001050000-0x0000000001051000-memory.dmp

Download

memory/2140-13-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2140-12-0x0000000010590000-0x000000001060C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads