remcos | 2e928af33de11fedaf5d0c388e96ac67509b64bd445a3f4a576f46ec2a0d5374

Analysis

max time kernel
149s
max time network
148s
platform
windows10_x64
resource
win10v20210408
submitted
03/05/2021, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eFiling EMP Statement_272552282276258227262.exe
Size 770KB
Sample210503-qg7bqccqs2
SHA256 2e928af33de11fedaf5d0c388e96ac67509b64bd445a3f4a576f46ec2a0d5374
MD5 01d8d435128292d7d340d1d6218abaac
SHA1 674ab3d68de937396d0a12e2c3b72ecc59fd0743
SHA512 7e5fc3d5d510880eeae9e29c72ea19904b1d3cb350d27b13f51422a6f8766ba254821a5deb2710b24e7eab4bbeec8d44ec53d6adde3c7251ded040e347072aa2
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

216.38.7.225:6524

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ybporf = "C:\\Users\\Public\\Libraries\\fropbY.url"	eFiling EMP Statement_272552282276258227262.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78
PID 580 wrote to memory of 3356	580	eFiling EMP Statement_272552282276258227262.exe	78

C:\Users\Admin\AppData\Local\Temp\eFiling EMP Statement_272552282276258227262.exe
"C:\Users\Admin\AppData\Local\Temp\eFiling EMP Statement_272552282276258227262.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:3356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-114-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/3356-117-0x0000000003190000-0x000000000323E000-memory.dmp

Download

memory/3356-118-0x0000000003130000-0x0000000003131000-memory.dmp

Download

memory/3356-116-0x00000000030F0000-0x00000000030F1000-memory.dmp

Download

memory/3356-119-0x0000000003150000-0x0000000003151000-memory.dmp

Download

memory/3356-120-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/3356-121-0x0000000000400000-0x0000000000479000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads