remcos | 033f4d8bd914597ee146ea8761a3f79fceb4f49af99f411e9ee94775ed298179

Analysis

Target

0900000000000000000900.exe
Size

84KB
MD5

030daaca1bd4fc284e4b4ab63d1b6419
SHA1

088aa59dc4185f60d450087899a4964957e49319
SHA256

033f4d8bd914597ee146ea8761a3f79fceb4f49af99f411e9ee94775ed298179
SHA512

cccd2d4f70e54ba9de9d8b7b1cbf6ef59ce4820e6d2d231b7a073d8b2c4dafa49edbb9cb6baf926075ad9e9bf23289e71ed48a3db8a8dc7f2a5076a921626b6c

Score

10^/10

remcos rat

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Loads dropped DLL 1 IoCs

Processes:

0900000000000000000900.exe

pid process

1688 0900000000000000000900.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

0900000000000000000900.exe

description pid process target process

PID 1688 set thread context of 1984 1688 0900000000000000000900.exe 0900000000000000000900.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

0900000000000000000900.exe

pid process

1688 0900000000000000000900.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0900000000000000000900.exe

pid process

1984 0900000000000000000900.exe

pid	process
1688	0900000000000000000900.exe

description	pid	process	target process
PID 1688 set thread context of 1984	1688	0900000000000000000900.exe	0900000000000000000900.exe

pid	process
1688	0900000000000000000900.exe

pid	process
1984	0900000000000000000900.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

0900000000000000000900.exe

description	pid	process	target process
PID 1688 wrote to memory of 1984	1688	0900000000000000000900.exe	0900000000000000000900.exe
PID 1688 wrote to memory of 1984	1688	0900000000000000000900.exe	0900000000000000000900.exe
PID 1688 wrote to memory of 1984	1688	0900000000000000000900.exe	0900000000000000000900.exe
PID 1688 wrote to memory of 1984	1688	0900000000000000000900.exe	0900000000000000000900.exe
PID 1688 wrote to memory of 1984	1688	0900000000000000000900.exe	0900000000000000000900.exe

C:\Users\Admin\AppData\Local\Temp\0900000000000000000900.exe
"C:\Users\Admin\AppData\Local\Temp\0900000000000000000900.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsc1086.tmp\k9i7b26ps.dll

MD5
96c19f4be5eb899973ad0090567c769e

SHA1
f52e2194466763adb44b604b2d06c0222e870c81

SHA256
c08e2ff95e39780720c26ec0535a05f23557d3e3122ed8f593dee2950ebef702

SHA512
963a02342ecceac16cdc671a57e9894e0a872cb7f8066c5a2dc810524c5e5c3eaac267917f2381ac6e54b94284a141ced956deefb44174a50f20673ce230b2f0

Download Submit
memory/1688-60-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1688-64-0x00000000004C0000-0x00000000004C4000-memory.dmp

Filesize
16KB

Download
memory/1984-62-0x00000000004172EC-mapping.dmp

Download
memory/1984-65-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download