remcos | 5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b

General

Target

EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
Size

186KB
MD5

57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1

b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA256

5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA512

1762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:3521

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exe

pid process

3128 PxxoServicesTrialNet1.exe
3340 PxxoServicesTrialNet1.exe

pid	process
3128	PxxoServicesTrialNet1.exe
3340	PxxoServicesTrialNet1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PxxoServicesTrialNet1.exeEXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	PxxoServicesTrialNet1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\""	PxxoServicesTrialNet1.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\""	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exePxxoServicesTrialNet1.exe

description	pid	process	target process
PID 3152 set thread context of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3128 set thread context of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe

description	pid	process
Token: SeDebugPrivilege	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PxxoServicesTrialNet1.exe

pid process

3340 PxxoServicesTrialNet1.exe

pid	process
3340	PxxoServicesTrialNet1.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exeEXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exeWScript.execmd.exePxxoServicesTrialNet1.exe

description	pid	process	target process
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 3152 wrote to memory of 2780	3152	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
PID 2780 wrote to memory of 3516	2780	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	WScript.exe
PID 2780 wrote to memory of 3516	2780	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	WScript.exe
PID 2780 wrote to memory of 3516	2780	EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe	WScript.exe
PID 3516 wrote to memory of 3972	3516	WScript.exe	cmd.exe
PID 3516 wrote to memory of 3972	3516	WScript.exe	cmd.exe
PID 3516 wrote to memory of 3972	3516	WScript.exe	cmd.exe
PID 3972 wrote to memory of 3128	3972	cmd.exe	PxxoServicesTrialNet1.exe
PID 3972 wrote to memory of 3128	3972	cmd.exe	PxxoServicesTrialNet1.exe
PID 3972 wrote to memory of 3128	3972	cmd.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 3128 wrote to memory of 3340	3128	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe

C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
"C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152

C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
"C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"
2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:3516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3128

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
a39af763b1c09ead3c98a6a615f377fe

SHA1
9bd3d39c89e47fe7072270ecc80b810103235c03

SHA256
a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f

SHA512
3ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7

SHA1
b0f907aa92d5b35b5b5fcad992f504525d04a87f

SHA256
5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b

SHA512
1762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7

SHA1
b0f907aa92d5b35b5b5fcad992f504525d04a87f

SHA256
5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b

SHA512
1762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7

SHA1
b0f907aa92d5b35b5b5fcad992f504525d04a87f

SHA256
5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b

SHA512
1762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305

Download Submit
C:\Users\Admin\D8D1mbf71F58n877GaUN8859f3063p51Xs9a9e0U5ZX1o12r9
MD5
d2c08b03c44b14ea8d9ef7827f218d57

SHA1
cbffc35201b1da903a9dc06a9c977b94a929f1ef

SHA256
c266f81e9d50d44dd7e1919ea64680e748f8ea7a41ba22ac3fa2f41a387cd6c0

SHA512
5e033f8ea03cffc66785919989923918b0f9ac57411c568c2d1929bb8c65bf40b63f0bdc8f875dc32131a04dbe89ae92777ec624446b2ed94f372895255f73ff

Download Submit
memory/2780-121-0x0000000000413FA4-mapping.dmp

Download
memory/2780-120-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2780-124-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3128-135-0x0000000004D20000-0x000000000521E000-memory.dmp

Filesize
5.0MB

Download
memory/3128-126-0x0000000000000000-mapping.dmp

Download
memory/3152-114-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/3152-119-0x00000000021A0000-0x00000000021C7000-memory.dmp

Filesize
156KB

Download
memory/3152-117-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/3152-118-0x00000000047B0000-0x0000000004CAE000-memory.dmp

Filesize
5.0MB

Download
memory/3152-116-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/3340-139-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3340-137-0x0000000000413FA4-mapping.dmp

Download
memory/3516-122-0x0000000000000000-mapping.dmp

Download
memory/3972-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads