remcos | 258853d56c202ea083607ec4d523335ed00c948afbf926f3cb62b4e962531812

General

Target

VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe
Size

571KB
MD5

49fb65d6058d42c8eded715bf9029c57
SHA1

7eb2579aaae05ea1c30d2d71cd349857e725ed08
SHA256

258853d56c202ea083607ec4d523335ed00c948afbf926f3cb62b4e962531812
SHA512

d54d6fe594988e322755e177910fb815632a9e44b476a1da91c7605715de4968286f1d16e557e2baa8450c543380ceecd3d97e1ae5adea0466ad30174385b920

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

indira8923.duckdns.org:1717

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe

description	pid	process	target process
PID 4056 set thread context of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4016 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe

pid process

4056 VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe

description pid process

Token: SeDebugPrivilege 4056 VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1956 RegSvcs.exe

pid	process
4016	schtasks.exe

pid	process
4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe

description	pid	process
Token: SeDebugPrivilege	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe

pid	process
1956	RegSvcs.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe

description	pid	process	target process
PID 4056 wrote to memory of 4016	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	schtasks.exe
PID 4056 wrote to memory of 4016	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	schtasks.exe
PID 4056 wrote to memory of 4016	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	schtasks.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe
PID 4056 wrote to memory of 1956	4056	VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe
"C:\Users\Admin\AppData\Local\Temp\VINCPORPROCEPORFRAUFIS346440007 VINCPORPROCEPORFRAUFIS346440009.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uytviDOfOOB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9233.tmp"
2⤵
- Creates scheduled task(s)
PID:4016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9233.tmp
MD5
f16bb7c545f152d576b9900f48d7dc30

SHA1
2705d20981819b3cfe7abc2d1d7ea711d1b4cda2

SHA256
daddd4d23f28023470b1d34d10db1306c1ee375683b67e096faf8ebc9849183a

SHA512
d2e97672ce11932d76483bc2de57572e9940ef513ce08493f70b1ec98f9c9d5a1f133fad95af8d4dddd133c8a1f538a8d655f4e469c8b72bf18eea2b300cb9cf

Download Submit
memory/1956-128-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1956-127-0x0000000000413E54-mapping.dmp

Download
memory/1956-126-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4016-124-0x0000000000000000-mapping.dmp

Download
memory/4056-118-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/4056-121-0x0000000005950000-0x0000000005955000-memory.dmp

Filesize
20KB

Download
memory/4056-122-0x0000000007DF0000-0x0000000007E85000-memory.dmp

Filesize
596KB

Download
memory/4056-123-0x000000000A390000-0x000000000A3DB000-memory.dmp

Filesize
300KB

Download
memory/4056-120-0x00000000056A0000-0x0000000005B9E000-memory.dmp

Filesize
5.0MB

Download
memory/4056-119-0x0000000007AD0000-0x0000000007AD1000-memory.dmp

Filesize
4KB

Download
memory/4056-114-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/4056-117-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/4056-116-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads