remcos | 419000b66f04ce0f9b5b3b9f4825d4b68d21df27e99d02b483bd96aa240413d7

General

Target

FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe
Size

955KB
MD5

66bc12a8ad1e13c3e6dd65bd6db4790a
SHA1

61048635297de9edf916ab5c2bbeeac865cad997
SHA256

419000b66f04ce0f9b5b3b9f4825d4b68d21df27e99d02b483bd96aa240413d7
SHA512

0f9fe805f7926a686382da2acc24da889be640b1951eb1a68c4f853aca56e7f3b1ff13d213d419f18e64b49f7a1c38edec556e2531d89c44e02755b286cec1aa

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

portugal16.duckdns.org:1717

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe

description pid process target process

PID 624 set thread context of 1968 624 FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3032 schtasks.exe

description	pid	process	target process
PID 624 set thread context of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe

pid	process
3032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe

pid	process
624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe
624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe
624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe
624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe
624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe
624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe

description pid process

Token: SeDebugPrivilege 624 FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1968 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe

pid	process
1968	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe

description	pid	process	target process
PID 624 wrote to memory of 3032	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	schtasks.exe
PID 624 wrote to memory of 3032	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	schtasks.exe
PID 624 wrote to memory of 3032	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	schtasks.exe
PID 624 wrote to memory of 3176	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 3176	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 3176	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe
PID 624 wrote to memory of 1968	624	FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe
"C:\Users\Admin\AppData\Local\Temp\FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GbbHlpGhB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFAD1.tmp"
2⤵
- Creates scheduled task(s)
PID:3032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:3176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFAD1.tmp
MD5
dcb0c5e9d2bea40dac0d8bc2eb642a7e

SHA1
5249ae315266268d141c7d69d9ceffacbf2da86c

SHA256
f0706a4612ccc2f168ba8fa3b31df37274d4be7663d4e466fdfd43f27e21e42d

SHA512
d5f9cf3b924f7144340dc1c139a7336d7ef70d362ecb543012be45a268683c92dc334bf8da6a73a4a3f25b8c4d20590831012df602c985edadb4c52ba8cc5d62

Download Submit
memory/624-121-0x00000000059E0000-0x00000000059E5000-memory.dmp

Filesize
20KB

Download
memory/624-123-0x00000000090D0000-0x0000000009166000-memory.dmp

Filesize
600KB

Download
memory/624-118-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/624-119-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/624-120-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/624-114-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/624-122-0x0000000006310000-0x0000000006311000-memory.dmp

Filesize
4KB

Download
memory/624-117-0x0000000005B00000-0x0000000005B01000-memory.dmp

Filesize
4KB

Download
memory/624-124-0x0000000007B20000-0x0000000007B6D000-memory.dmp

Filesize
308KB

Download
memory/624-116-0x0000000007780000-0x00000000077FF000-memory.dmp

Filesize
508KB

Download
memory/1968-127-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1968-128-0x0000000000413E54-mapping.dmp

Download
memory/1968-129-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads