remcos | 414a14294a3c88613f1480a69fa0d7cf3dfbb83eedd5ef0acc3ad39f6e01ee65

General

Target
787cbb388c2388d8911e406f8b5060b6.exe
Size 180KB
Sample210307-vg2c53kyve
SHA256 414a14294a3c88613f1480a69fa0d7cf3dfbb83eedd5ef0acc3ad39f6e01ee65
MD5 787cbb388c2388d8911e406f8b5060b6
SHA1 86d0019ff312c12ceb84587ed9bfa46db495e67a
SHA512 2b4a4039c5312a26dc4de7e40d99342ca0fc2e5f09ae096810529708768f83ccb83358106a0e06380c97545b5b48b010f205da24ffd8399638b7dbfbd627bf5c
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
800	win.exe

Loads dropped DLL 1 IoCs

pid	Process
1220	win.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\""	787cbb388c2388d8911e406f8b5060b6.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	win.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\""	win.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	787cbb388c2388d8911e406f8b5060b6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
4692	787cbb388c2388d8911e406f8b5060b6.exe
4068	787cbb388c2388d8911e406f8b5060b6.exe
4068	787cbb388c2388d8911e406f8b5060b6.exe
800	win.exe
1220	win.exe
1220	win.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4692 set thread context of 4068	4692	787cbb388c2388d8911e406f8b5060b6.exe	78
PID 800 set thread context of 1220	800	win.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	787cbb388c2388d8911e406f8b5060b6.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4692	787cbb388c2388d8911e406f8b5060b6.exe
800	win.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4692	787cbb388c2388d8911e406f8b5060b6.exe
800	win.exe
1220	win.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4068	4692	787cbb388c2388d8911e406f8b5060b6.exe	78
PID 4692 wrote to memory of 4068	4692	787cbb388c2388d8911e406f8b5060b6.exe	78
PID 4692 wrote to memory of 4068	4692	787cbb388c2388d8911e406f8b5060b6.exe	78
PID 4692 wrote to memory of 4068	4692	787cbb388c2388d8911e406f8b5060b6.exe	78
PID 4068 wrote to memory of 504	4068	787cbb388c2388d8911e406f8b5060b6.exe	79
PID 4068 wrote to memory of 504	4068	787cbb388c2388d8911e406f8b5060b6.exe	79
PID 4068 wrote to memory of 504	4068	787cbb388c2388d8911e406f8b5060b6.exe	79
PID 504 wrote to memory of 844	504	WScript.exe	80
PID 504 wrote to memory of 844	504	WScript.exe	80
PID 504 wrote to memory of 844	504	WScript.exe	80
PID 844 wrote to memory of 800	844	cmd.exe	82
PID 844 wrote to memory of 800	844	cmd.exe	82
PID 844 wrote to memory of 800	844	cmd.exe	82
PID 800 wrote to memory of 1220	800	win.exe	83
PID 800 wrote to memory of 1220	800	win.exe	83
PID 800 wrote to memory of 1220	800	win.exe	83
PID 800 wrote to memory of 1220	800	win.exe	83

C:\Users\Admin\AppData\Local\Temp\787cbb388c2388d8911e406f8b5060b6.exe
"C:\Users\Admin\AppData\Local\Temp\787cbb388c2388d8911e406f8b5060b6.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\787cbb388c2388d8911e406f8b5060b6.exe
  "C:\Users\Admin\AppData\Local\Temp\787cbb388c2388d8911e406f8b5060b6.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:504
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\win.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:844
    - - C:\Users\Admin\AppData\Roaming\win.exe
        
        C:\Users\Admin\AppData\Roaming\win.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:800
      - C:\Users\Admin\AppData\Roaming\win.exe
        
        C:\Users\Admin\AppData\Roaming\win.exe
        6⤵
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-21-0x0000000000560000-0x0000000000660000-memory.dmp

Download

memory/4068-6-0x0000000000401000-0x00000000004FD000-memory.dmp

Download

memory/4068-7-0x0000000000560000-0x0000000000660000-memory.dmp

Download

memory/4068-8-0x0000000000401000-0x0000000000541000-memory.dmp

Download

memory/4692-4-0x0000000002190000-0x00000000021A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads