remcos | eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

General

Target

EXTRACTOSERFINANZA989543704031499704092798964.exe
Size

1.8MB
MD5

2e91e5e3d39ce4155edad4f2a3acf916
SHA1

58adf5d60d9da823a4fd62282c0c46134e20e47b
SHA256

eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21
SHA512

5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:3521

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exe

pid process

1284 PxxoServicesTrialNet1.exe
1632 PxxoServicesTrialNet1.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1016 cmd.exe

pid	process
1284	PxxoServicesTrialNet1.exe
1632	PxxoServicesTrialNet1.exe

pid	process
1016	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PxxoServicesTrialNet1.exeEXTRACTOSERFINANZA989543704031499704092798964.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\""	PxxoServicesTrialNet1.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\	EXTRACTOSERFINANZA989543704031499704092798964.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\""	EXTRACTOSERFINANZA989543704031499704092798964.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\	PxxoServicesTrialNet1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

EXTRACTOSERFINANZA989543704031499704092798964.exePxxoServicesTrialNet1.exe

pid	process
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
1284	PxxoServicesTrialNet1.exe
1284	PxxoServicesTrialNet1.exe
1284	PxxoServicesTrialNet1.exe
1284	PxxoServicesTrialNet1.exe
1284	PxxoServicesTrialNet1.exe
1284	PxxoServicesTrialNet1.exe
1284	PxxoServicesTrialNet1.exe
1284	PxxoServicesTrialNet1.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

EXTRACTOSERFINANZA989543704031499704092798964.exePxxoServicesTrialNet1.exe

description	pid	process	target process
PID 452 set thread context of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 1284 set thread context of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

1528 timeout.exe
652 timeout.exe

pid	process
1528	timeout.exe
652	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

EXTRACTOSERFINANZA989543704031499704092798964.exePxxoServicesTrialNet1.exe

pid	process
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
452	EXTRACTOSERFINANZA989543704031499704092798964.exe
1284	PxxoServicesTrialNet1.exe
1284	PxxoServicesTrialNet1.exe
1284	PxxoServicesTrialNet1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

EXTRACTOSERFINANZA989543704031499704092798964.exePxxoServicesTrialNet1.exe

description pid process

Token: SeDebugPrivilege 452 EXTRACTOSERFINANZA989543704031499704092798964.exe
Token: SeDebugPrivilege 1284 PxxoServicesTrialNet1.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PxxoServicesTrialNet1.exe

pid process

1632 PxxoServicesTrialNet1.exe

description	pid	process
Token: SeDebugPrivilege	452	EXTRACTOSERFINANZA989543704031499704092798964.exe
Token: SeDebugPrivilege	1284	PxxoServicesTrialNet1.exe

pid	process
1632	PxxoServicesTrialNet1.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

EXTRACTOSERFINANZA989543704031499704092798964.execmd.exeEXTRACTOSERFINANZA989543704031499704092798964.exeWScript.execmd.exePxxoServicesTrialNet1.execmd.exe

description	pid	process	target process
PID 452 wrote to memory of 1100	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	cmd.exe
PID 452 wrote to memory of 1100	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	cmd.exe
PID 452 wrote to memory of 1100	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	cmd.exe
PID 452 wrote to memory of 1100	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	cmd.exe
PID 1100 wrote to memory of 1528	1100	cmd.exe	timeout.exe
PID 1100 wrote to memory of 1528	1100	cmd.exe	timeout.exe
PID 1100 wrote to memory of 1528	1100	cmd.exe	timeout.exe
PID 1100 wrote to memory of 1528	1100	cmd.exe	timeout.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 452 wrote to memory of 428	452	EXTRACTOSERFINANZA989543704031499704092798964.exe	EXTRACTOSERFINANZA989543704031499704092798964.exe
PID 428 wrote to memory of 1404	428	EXTRACTOSERFINANZA989543704031499704092798964.exe	WScript.exe
PID 428 wrote to memory of 1404	428	EXTRACTOSERFINANZA989543704031499704092798964.exe	WScript.exe
PID 428 wrote to memory of 1404	428	EXTRACTOSERFINANZA989543704031499704092798964.exe	WScript.exe
PID 428 wrote to memory of 1404	428	EXTRACTOSERFINANZA989543704031499704092798964.exe	WScript.exe
PID 1404 wrote to memory of 1016	1404	WScript.exe	cmd.exe
PID 1404 wrote to memory of 1016	1404	WScript.exe	cmd.exe
PID 1404 wrote to memory of 1016	1404	WScript.exe	cmd.exe
PID 1404 wrote to memory of 1016	1404	WScript.exe	cmd.exe
PID 1016 wrote to memory of 1284	1016	cmd.exe	PxxoServicesTrialNet1.exe
PID 1016 wrote to memory of 1284	1016	cmd.exe	PxxoServicesTrialNet1.exe
PID 1016 wrote to memory of 1284	1016	cmd.exe	PxxoServicesTrialNet1.exe
PID 1016 wrote to memory of 1284	1016	cmd.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1784	1284	PxxoServicesTrialNet1.exe	cmd.exe
PID 1284 wrote to memory of 1784	1284	PxxoServicesTrialNet1.exe	cmd.exe
PID 1284 wrote to memory of 1784	1284	PxxoServicesTrialNet1.exe	cmd.exe
PID 1284 wrote to memory of 1784	1284	PxxoServicesTrialNet1.exe	cmd.exe
PID 1784 wrote to memory of 652	1784	cmd.exe	timeout.exe
PID 1784 wrote to memory of 652	1784	cmd.exe	timeout.exe
PID 1784 wrote to memory of 652	1784	cmd.exe	timeout.exe
PID 1784 wrote to memory of 652	1784	cmd.exe	timeout.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe
PID 1284 wrote to memory of 1632	1284	PxxoServicesTrialNet1.exe	PxxoServicesTrialNet1.exe

C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA989543704031499704092798964.exe
"C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA989543704031499704092798964.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1528

C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA989543704031499704092798964.exe
"C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA989543704031499704092798964.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
6⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\timeout.exe
timeout 1
7⤵
- Delays execution with timeout.exe
PID:652

C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
a39af763b1c09ead3c98a6a615f377fe

SHA1
9bd3d39c89e47fe7072270ecc80b810103235c03

SHA256
a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f

SHA512
3ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
2e91e5e3d39ce4155edad4f2a3acf916

SHA1
58adf5d60d9da823a4fd62282c0c46134e20e47b

SHA256
eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

SHA512
5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
2e91e5e3d39ce4155edad4f2a3acf916

SHA1
58adf5d60d9da823a4fd62282c0c46134e20e47b

SHA256
eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

SHA512
5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

Download Submit
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
2e91e5e3d39ce4155edad4f2a3acf916

SHA1
58adf5d60d9da823a4fd62282c0c46134e20e47b

SHA256
eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

SHA512
5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

Download Submit
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
MD5
2e91e5e3d39ce4155edad4f2a3acf916

SHA1
58adf5d60d9da823a4fd62282c0c46134e20e47b

SHA256
eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

SHA512
5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

Download Submit
memory/428-65-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/428-67-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/428-71-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/428-66-0x0000000000413FA4-mapping.dmp

Download
memory/452-64-0x0000000006110000-0x0000000006111000-memory.dmp

Filesize
4KB

Download
memory/452-61-0x0000000000360000-0x000000000039E000-memory.dmp

Filesize
248KB

Download
memory/452-59-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/652-81-0x0000000000000000-mapping.dmp

Download
memory/1016-72-0x0000000000000000-mapping.dmp

Download
memory/1100-62-0x0000000000000000-mapping.dmp

Download
memory/1284-75-0x0000000000000000-mapping.dmp

Download
memory/1284-77-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1284-82-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/1404-68-0x0000000000000000-mapping.dmp

Download
memory/1528-63-0x0000000000000000-mapping.dmp

Download
memory/1632-84-0x0000000000413FA4-mapping.dmp

Download
memory/1632-87-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1784-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads