remcos | 37d06b4e6ec408584c915ba339a3b1c7a8d49a8b9a1c7e95422b149560c6909f

General

Target

first1.exe
Size

183KB
MD5

c1b9c27c13f700813890b186b09bf55a
SHA1

a816f0a3df54453fd3dec7e91cc17d0eeb74ee81
SHA256

e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905
SHA512

5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:3521

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exe

pid process

2116 PxxoServicesTrialNet1.exe
1972 PxxoServicesTrialNet1.exe

pid	process
2116	PxxoServicesTrialNet1.exe
1972	PxxoServicesTrialNet1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PxxoServicesTrialNet1.exefirst1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	PxxoServicesTrialNet1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\""	PxxoServicesTrialNet1.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	first1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\""	first1.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

first1.exePxxoServicesTrialNet1.exe

description	pid	process	target process
PID 760 set thread context of 2396	760	first1.exe	first1.exe
PID 2116 set thread context of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

first1.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings first1.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

first1.exe

description pid process

Token: SeDebugPrivilege 760 first1.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PxxoServicesTrialNet1.exe

pid process

1972 PxxoServicesTrialNet1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	first1.exe

description	pid	process
Token: SeDebugPrivilege	760	first1.exe

pid	process
1972	PxxoServicesTrialNet1.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

first1.exefirst1.exeWScript.execmd.exePxxoServicesTrialNet1.exe

description	pid	process	target process
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 760 wrote to memory of 2396	760	first1.exe	first1.exe
PID 2396 wrote to memory of 2688	2396	first1.exe	WScript.exe
PID 2396 wrote to memory of 2688	2396	first1.exe	WScript.exe
PID 2396 wrote to memory of 2688	2396	first1.exe	WScript.exe
PID 2688 wrote to memory of 3564	2688	WScript.exe	cmd.exe
PID 2688 wrote to memory of 3564	2688	WScript.exe	cmd.exe
PID 2688 wrote to memory of 3564	2688	WScript.exe	cmd.exe
PID 3564 wrote to memory of 2116	3564	cmd.exe	PxxoServicesTrialNet1.exe
PID 3564 wrote to memory of 2116	3564	cmd.exe	PxxoServicesTrialNet1.exe
PID 3564 wrote to memory of 2116	3564	cmd.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 2116 wrote to memory of 1972	2116	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe

C:\Users\Admin\AppData\Local\Temp\first1.exe
"C:\Users\Admin\AppData\Local\Temp\first1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760

C:\Users\Admin\AppData\Local\Temp\first1.exe
"C:\Users\Admin\AppData\Local\Temp\first1.exe"
2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:3564

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\8Ob78d1213R19c0VT2c4ffA9ft3n6
MD5
6f8f8293dc8a44fe2ef5c69d9db25199

SHA1
6d0e9538e03e566a64eb63cb3e96c68cdf85ab56

SHA256
c9830c1b9f4c7beccf2775607bce666beb965c27682a70e2425370a226c9f766

SHA512
33cc42c801b03683c1d1f586788f699a1710a3c8709da369d81b4c296eb6f7b6aafeb407f0f10981065b760f14053b51846c74d692db0f3c6292bf0b7c376aec

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
a39af763b1c09ead3c98a6a615f377fe

SHA1
9bd3d39c89e47fe7072270ecc80b810103235c03

SHA256
a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f

SHA512
3ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
c1b9c27c13f700813890b186b09bf55a

SHA1
a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

SHA256
e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

SHA512
5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
c1b9c27c13f700813890b186b09bf55a

SHA1
a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

SHA256
e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

SHA512
5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
c1b9c27c13f700813890b186b09bf55a

SHA1
a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

SHA256
e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

SHA512
5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Download Submit
memory/760-119-0x0000000006760000-0x0000000006789000-memory.dmp

Filesize
164KB

Download
memory/760-118-0x0000000005820000-0x0000000005D1E000-memory.dmp

Filesize
5.0MB

Download
memory/760-116-0x0000000005D20000-0x0000000005D21000-memory.dmp

Filesize
4KB

Download
memory/760-117-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/760-114-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/1972-139-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1972-137-0x0000000000413FA4-mapping.dmp

Download
memory/2116-135-0x0000000005260000-0x000000000575E000-memory.dmp

Filesize
5.0MB

Download
memory/2116-126-0x0000000000000000-mapping.dmp

Download
memory/2396-121-0x0000000000413FA4-mapping.dmp

Download
memory/2396-124-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2396-120-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2688-122-0x0000000000000000-mapping.dmp

Download
memory/3564-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads