remcos | 4fff31fe2dc28e3080189ef8bdf5001f1a441be3c67392864966512d7dc79217

General

Target

Neues Lieferantenformular,pdf.scr
Size

832KB
MD5

3f4f150ed7ab62f3f08315fa85a1e1f0
SHA1

24890995fabbfb50230729d5cceb4d5a92199a42
SHA256

f0896ba259cc40a67474db857cbca2cd43099f5b49be45c3e3a3a34a06765b7f
SHA512

67df52b24d57dc399c2c819d27749e8b54b7494563d075c7305716d57eae1625321ea8083c1964d76721a1ec436e5a0d53403c2c737d895c9068c0632ea78248

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

Officialsw.chickenkiller.com:2310

official.ydns.eu:2310

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

40 3564 mshta.exe

flow	pid	process
40	3564	mshta.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Neues Lieferantenformular,pdf.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rwdfnm = "C:\\Users\\Admin\\AppData\\Local\\mnfdwR.url"	Neues Lieferantenformular,pdf.scr

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Neues Lieferantenformular,pdf.scr

description	pid	process	target process
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe
PID 3424 wrote to memory of 3564	3424	Neues Lieferantenformular,pdf.scr	mshta.exe

C:\Users\Admin\AppData\Local\Temp\Neues Lieferantenformular,pdf.scr
"C:\Users\Admin\AppData\Local\Temp\Neues Lieferantenformular,pdf.scr" /S
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\SysWOW64\mshta.exe
C:\Windows\System32\mshta.exe
2⤵
- Blocklisted process makes network request
PID:3564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3424-114-0x00000000005F0000-0x000000000073A000-memory.dmp

Filesize
1.3MB

Download
memory/3424-116-0x0000000002980000-0x000000000299A000-memory.dmp

Filesize
104KB

Download
memory/3564-119-0x0000000000000000-mapping.dmp

Download
memory/3564-121-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/3564-120-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/3564-123-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/3564-125-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3564-124-0x0000000010590000-0x000000001060B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing