remcos | b782581b1ca3da09fdf3ecbb173ee3ca1f313f5f325f407df976601cad8ce839

Analysis

max time kernel
149s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
02/03/2021, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO AR483-1590436 FOR J-3000433707 PROJT.exe
Size 1.1MB
Sample210302-389thdh832
SHA256 b782581b1ca3da09fdf3ecbb173ee3ca1f313f5f325f407df976601cad8ce839
MD5 40816f91fa4c2ea57edd6933dbf5b1b8
SHA1 f29c3c60e4281577b6fe65073160a1f560f71c2a
SHA512 69f0c9fc6f46050289bdac7dda78737d40f6c9208177b030400b2d3295aba6b3850f77c671531990757a336b3c64b6b8289554e07cd5a11b378aed2c63ca48bc
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

tulicknewfavour.ddns.net:4033

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3868-16-0x0000000000476274-mapping.dmp	WebBrowserPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/memory/3868-16-0x0000000000476274-mapping.dmp	Nirsoft

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wbxoj = "C:\\Users\\Public\\Libraries\\joxbW.url"	PO AR483-1590436 FOR J-3000433707 PROJT.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 972 set thread context of 3868	972	eventvwr.exe	80
PID 972 set thread context of 4004	972	eventvwr.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3868	eventvwr.exe
3868	eventvwr.exe
3868	eventvwr.exe
3868	eventvwr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
972	eventvwr.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 1276 wrote to memory of 972	1276	PO AR483-1590436 FOR J-3000433707 PROJT.exe	79
PID 972 wrote to memory of 3868	972	eventvwr.exe	80
PID 972 wrote to memory of 3868	972	eventvwr.exe	80
PID 972 wrote to memory of 3868	972	eventvwr.exe	80
PID 972 wrote to memory of 3868	972	eventvwr.exe	80
PID 972 wrote to memory of 3868	972	eventvwr.exe	80
PID 972 wrote to memory of 3868	972	eventvwr.exe	80
PID 972 wrote to memory of 3868	972	eventvwr.exe	80
PID 972 wrote to memory of 3868	972	eventvwr.exe	80
PID 972 wrote to memory of 3856	972	eventvwr.exe	81
PID 972 wrote to memory of 3856	972	eventvwr.exe	81
PID 972 wrote to memory of 3856	972	eventvwr.exe	81
PID 972 wrote to memory of 4004	972	eventvwr.exe	82
PID 972 wrote to memory of 4004	972	eventvwr.exe	82
PID 972 wrote to memory of 4004	972	eventvwr.exe	82
PID 972 wrote to memory of 4004	972	eventvwr.exe	82
PID 972 wrote to memory of 4004	972	eventvwr.exe	82
PID 972 wrote to memory of 4004	972	eventvwr.exe	82
PID 972 wrote to memory of 4004	972	eventvwr.exe	82
PID 972 wrote to memory of 4004	972	eventvwr.exe	82

C:\Users\Admin\AppData\Local\Temp\PO AR483-1590436 FOR J-3000433707 PROJT.exe
"C:\Users\Admin\AppData\Local\Temp\PO AR483-1590436 FOR J-3000433707 PROJT.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\eventvwr.exe
  C:\Windows\System32\eventvwr.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\SysWOW64\eventvwr.exe
    C:\Windows\SysWOW64\eventvwr.exe /stext "C:\Users\Admin\AppData\Local\Temp\uloepuubuhzqdxnmjzobyvnxy"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3868
- - C:\Windows\SysWOW64\eventvwr.exe
    C:\Windows\SysWOW64\eventvwr.exe /stext "C:\Users\Admin\AppData\Local\Temp\eftpqmfuqprdoebyskbdjiiohjil"
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\eventvwr.exe
    C:\Windows\SysWOW64\eventvwr.exe /stext "C:\Users\Admin\AppData\Local\Temp\phgiqepwexjiqsxccvowmncfiprukxs"
    3⤵
    PID:4004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-12-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/972-6-0x0000000003320000-0x0000000003321000-memory.dmp

Download

memory/972-8-0x0000000003380000-0x0000000003381000-memory.dmp

Download

memory/972-13-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/972-4-0x0000000003260000-0x0000000003261000-memory.dmp

Download

memory/1276-3-0x00000000023A0000-0x00000000023BB000-memory.dmp

Download

memory/1276-2-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3868-15-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3868-19-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4004-17-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4004-20-0x0000000000400000-0x0000000000457000-memory.dmp

Download