remcos | e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

General

Target

Factura Serfinanza089768553548090985869814228.exe
Size

183KB
MD5

c1b9c27c13f700813890b186b09bf55a
SHA1

a816f0a3df54453fd3dec7e91cc17d0eeb74ee81
SHA256

e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905
SHA512

5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:3521

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 3 IoCs

Processes:

PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exePxxoServicesTrialNet1.exe

pid process

540 PxxoServicesTrialNet1.exe
1492 PxxoServicesTrialNet1.exe
1384 PxxoServicesTrialNet1.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1648 cmd.exe

pid	process
540	PxxoServicesTrialNet1.exe
1492	PxxoServicesTrialNet1.exe
1384	PxxoServicesTrialNet1.exe

pid	process
1648	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Factura Serfinanza089768553548090985869814228.exePxxoServicesTrialNet1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Factura Serfinanza089768553548090985869814228.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\""	Factura Serfinanza089768553548090985869814228.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\	PxxoServicesTrialNet1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\""	PxxoServicesTrialNet1.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Factura Serfinanza089768553548090985869814228.exePxxoServicesTrialNet1.exe

description	pid	process	target process
PID 1268 set thread context of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 540 set thread context of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PxxoServicesTrialNet1.exe

pid process

540 PxxoServicesTrialNet1.exe
540 PxxoServicesTrialNet1.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Factura Serfinanza089768553548090985869814228.exePxxoServicesTrialNet1.exe

description pid process

Token: SeDebugPrivilege 1268 Factura Serfinanza089768553548090985869814228.exe
Token: SeDebugPrivilege 540 PxxoServicesTrialNet1.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PxxoServicesTrialNet1.exe

pid process

1384 PxxoServicesTrialNet1.exe

pid	process
540	PxxoServicesTrialNet1.exe
540	PxxoServicesTrialNet1.exe

description	pid	process
Token: SeDebugPrivilege	1268	Factura Serfinanza089768553548090985869814228.exe
Token: SeDebugPrivilege	540	PxxoServicesTrialNet1.exe

pid	process
1384	PxxoServicesTrialNet1.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

Factura Serfinanza089768553548090985869814228.exeFactura Serfinanza089768553548090985869814228.exeWScript.execmd.exePxxoServicesTrialNet1.exe

description	pid	process	target process
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1268 wrote to memory of 1012	1268	Factura Serfinanza089768553548090985869814228.exe	Factura Serfinanza089768553548090985869814228.exe
PID 1012 wrote to memory of 980	1012	Factura Serfinanza089768553548090985869814228.exe	WScript.exe
PID 1012 wrote to memory of 980	1012	Factura Serfinanza089768553548090985869814228.exe	WScript.exe
PID 1012 wrote to memory of 980	1012	Factura Serfinanza089768553548090985869814228.exe	WScript.exe
PID 1012 wrote to memory of 980	1012	Factura Serfinanza089768553548090985869814228.exe	WScript.exe
PID 980 wrote to memory of 1648	980	WScript.exe	cmd.exe
PID 980 wrote to memory of 1648	980	WScript.exe	cmd.exe
PID 980 wrote to memory of 1648	980	WScript.exe	cmd.exe
PID 980 wrote to memory of 1648	980	WScript.exe	cmd.exe
PID 1648 wrote to memory of 540	1648	cmd.exe	PxxoServicesTrialNet1.exe
PID 1648 wrote to memory of 540	1648	cmd.exe	PxxoServicesTrialNet1.exe
PID 1648 wrote to memory of 540	1648	cmd.exe	PxxoServicesTrialNet1.exe
PID 1648 wrote to memory of 540	1648	cmd.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1492	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1492	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1492	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1492	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 540 wrote to memory of 1384	540	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe

C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza089768553548090985869814228.exe
"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza089768553548090985869814228.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza089768553548090985869814228.exe
"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza089768553548090985869814228.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
6⤵
- Executes dropped EXE
PID:1492

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\8Ob78d1213R19c0VT2c4ffA9ft3n6

MD5
6f8f8293dc8a44fe2ef5c69d9db25199

SHA1
6d0e9538e03e566a64eb63cb3e96c68cdf85ab56

SHA256
c9830c1b9f4c7beccf2775607bce666beb965c27682a70e2425370a226c9f766

SHA512
33cc42c801b03683c1d1f586788f699a1710a3c8709da369d81b4c296eb6f7b6aafeb407f0f10981065b760f14053b51846c74d692db0f3c6292bf0b7c376aec

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5
a39af763b1c09ead3c98a6a615f377fe

SHA1
9bd3d39c89e47fe7072270ecc80b810103235c03

SHA256
a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f

SHA512
3ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe

MD5
c1b9c27c13f700813890b186b09bf55a

SHA1
a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

SHA256
e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

SHA512
5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe

MD5
c1b9c27c13f700813890b186b09bf55a

SHA1
a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

SHA256
e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

SHA512
5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe

MD5
c1b9c27c13f700813890b186b09bf55a

SHA1
a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

SHA256
e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

SHA512
5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe

MD5
c1b9c27c13f700813890b186b09bf55a

SHA1
a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

SHA256
e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

SHA512
5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Download Submit
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe

MD5
c1b9c27c13f700813890b186b09bf55a

SHA1
a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

SHA256
e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

SHA512
5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Download Submit
memory/540-76-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/540-80-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/540-74-0x0000000000000000-mapping.dmp

Download
memory/980-67-0x0000000000000000-mapping.dmp

Download
memory/1012-64-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1012-65-0x0000000000413FA4-mapping.dmp

Download
memory/1012-70-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1268-62-0x0000000004610000-0x0000000004611000-memory.dmp

Filesize
4KB

Download
memory/1268-61-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1268-59-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1268-63-0x0000000000500000-0x0000000000529000-memory.dmp

Filesize
164KB

Download
memory/1384-83-0x0000000000413FA4-mapping.dmp

Download
memory/1384-86-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1648-71-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads