remcos | 7a1ca0872400fc383eea460f0eb93927610a9ba28cd74dfa8f37d11a2b2b6d71

General

Target

RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe
Size

801KB
MD5

cdbe179ccd3e2676a8149430dd4d2027
SHA1

dd79a36de18f788899276805f2efcaf2a6295b7a
SHA256

7a1ca0872400fc383eea460f0eb93927610a9ba28cd74dfa8f37d11a2b2b6d71
SHA512

703e87d7b5986a3c9a486a3fc5ced5ce49f89ba1469145562f86c037e733f84f9d324d362b5f3936f770c71d090a962613cc9e015e811ab14a0d75f521adf1f6

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

electricaribe.duckdns.org:1717

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe

description	pid	process	target process
PID 640 set thread context of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3260 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe

pid process

640 RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe

description pid process

Token: SeDebugPrivilege 640 RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1312 RegSvcs.exe

pid	process
3260	schtasks.exe

pid	process
640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe

description	pid	process
Token: SeDebugPrivilege	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe

pid	process
1312	RegSvcs.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe

description	pid	process	target process
PID 640 wrote to memory of 3260	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	schtasks.exe
PID 640 wrote to memory of 3260	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	schtasks.exe
PID 640 wrote to memory of 3260	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	schtasks.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe
PID 640 wrote to memory of 1312	640	RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe
"C:\Users\Admin\AppData\Local\Temp\RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zHvfETCQIPJiU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1BC6.tmp"
2⤵
- Creates scheduled task(s)
PID:3260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1BC6.tmp

MD5
68dce738bb1b5418aa6c48470fc2f00d

SHA1
4ef847f987505d05f09f2aa1c31d92e9757590f7

SHA256
21d33346f37ca63ab24a64bce5d9ebc6c19a718ca57445aa0a3afb54254a61d1

SHA512
00ed906894b3c5a3637c364924359da2c48a636cfd0a7e8fdc30943bf1c3d49f1a09f231efe501ba07345a21d34c607b0d3010d19c484f9f64012f84700e817d

Download Submit
memory/640-121-0x0000000008D60000-0x0000000008D65000-memory.dmp

Filesize
20KB

Download
memory/640-117-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/640-118-0x0000000005750000-0x0000000005C4E000-memory.dmp

Filesize
5.0MB

Download
memory/640-119-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/640-120-0x0000000008F90000-0x0000000008F91000-memory.dmp

Filesize
4KB

Download
memory/640-114-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/640-122-0x000000000A2E0000-0x000000000A389000-memory.dmp

Filesize
676KB

Download
memory/640-123-0x0000000007480000-0x00000000074E0000-memory.dmp

Filesize
384KB

Download
memory/640-116-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/1312-126-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1312-127-0x0000000000413E54-mapping.dmp

Download
memory/1312-128-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3260-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads