remcos | 562d8f8c0557824cf0f95d646e61d38822ca8b661173f89c5b601cd1f4c4a824

General

Target

90800000900.exe
Size

546KB
MD5

390e87a9700a9d35c4042fb52cb59ae4
SHA1

b392394cd99600367d800a1565b35098a45d8fb6
SHA256

562d8f8c0557824cf0f95d646e61d38822ca8b661173f89c5b601cd1f4c4a824
SHA512

17265076ac622bc7af1cf54f5744e07d670f3447606e18e44d5f1e4ebc90ce99a95afa2e9eff5193e085edbebf9083219fdb7f87ba37b9f67bd7f031d341fc04

Score

10^/10

remcos rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Loads dropped DLL 2 IoCs

Processes:

90800000900.exe90800000900.exe

pid process

4656 90800000900.exe
4260 90800000900.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

90800000900.exe

description pid process target process

PID 4260 set thread context of 4272 4260 90800000900.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

90800000900.exe90800000900.exe

pid process

4656 90800000900.exe
4656 90800000900.exe
4260 90800000900.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

4272 svchost.exe

pid	process
4656	90800000900.exe
4260	90800000900.exe

description	pid	process	target process
PID 4260 set thread context of 4272	4260	90800000900.exe	svchost.exe

pid	process
4656	90800000900.exe
4656	90800000900.exe
4260	90800000900.exe

pid	process
4272	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

90800000900.exe90800000900.exe

description	pid	process	target process
PID 4656 wrote to memory of 752	4656	90800000900.exe	svchost.exe
PID 4656 wrote to memory of 752	4656	90800000900.exe	svchost.exe
PID 4656 wrote to memory of 752	4656	90800000900.exe	svchost.exe
PID 4656 wrote to memory of 4260	4656	90800000900.exe	90800000900.exe
PID 4656 wrote to memory of 4260	4656	90800000900.exe	90800000900.exe
PID 4656 wrote to memory of 4260	4656	90800000900.exe	90800000900.exe
PID 4260 wrote to memory of 4272	4260	90800000900.exe	svchost.exe
PID 4260 wrote to memory of 4272	4260	90800000900.exe	svchost.exe
PID 4260 wrote to memory of 4272	4260	90800000900.exe	svchost.exe
PID 4260 wrote to memory of 4272	4260	90800000900.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\90800000900.exe
"C:\Users\Admin\AppData\Local\Temp\90800000900.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\90800000900.exe"
2⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\90800000900.exe
"C:\Users\Admin\AppData\Local\Temp\90800000900.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\90800000900.exe"
3⤵
- Suspicious use of SetWindowsHookEx
PID:4272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jkb4wb0s8hl845i
MD5
c862a5d97efdb998ab05dc15bb2f56f7

SHA1
b7cd26dc32763884398a1c7dafef6ed61c28b1e4

SHA256
a424236970783cabced2cea2fe7c9db1310ce2a5ae003f9f6f335bbe13af2087

SHA512
6d0628d5696173f2f6df85cc2ebe3349ea40fb24bb632654f39fab30f16a1e895d6b84450c717893a5195596478a8d9b3ba67c5b2a11a1d3e0bfbb49e046bb49

Download Submit
C:\Users\Admin\AppData\Local\Temp\pghibv0x6bx6wvw
MD5
8a08d790604d5f8eadb76186b2274d29

SHA1
d85864beec10a23b5f7a7aa4d587295339fac22f

SHA256
5276753fe73db14384df8af312a5b32a0f907072a8d92dd7f79f902e5c3dd26a

SHA512
a0e5438aad0f24d296d5effc3589d9f048fc8a0af8585b2c64ac16ce4002172a250c51bb3d15da547153a04e3f35a0c0ad1cca4693e42aed604b8749b4f54ac2

Download Submit
\Users\Admin\AppData\Local\Temp\nsa87F3.tmp\qaeath0kvvyo.dll
MD5
ed8b651c2f29e13e9da1729527e486de

SHA1
9d33a86de13228dfbd559b35b58206e3794f32cf

SHA256
450498d4ca07110293f36108fd642f14ff17517d7b3cd952758db1824523f5b3

SHA512
3e271052f1625990589eb761d05c3bc18375556713f8c413f0ea21a335ca4c6a7cdac3ad97574b60e7766bb988c41ea03a85a443b88025c4cd45affa5d833ed7

Download Submit
\Users\Admin\AppData\Local\Temp\nsk7873.tmp\qaeath0kvvyo.dll
MD5
ed8b651c2f29e13e9da1729527e486de

SHA1
9d33a86de13228dfbd559b35b58206e3794f32cf

SHA256
450498d4ca07110293f36108fd642f14ff17517d7b3cd952758db1824523f5b3

SHA512
3e271052f1625990589eb761d05c3bc18375556713f8c413f0ea21a335ca4c6a7cdac3ad97574b60e7766bb988c41ea03a85a443b88025c4cd45affa5d833ed7

Download Submit
memory/4260-116-0x0000000000000000-mapping.dmp

Download
memory/4272-120-0x000000000047823F-mapping.dmp

Download
memory/4272-124-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4656-115-0x0000000000B30000-0x0000000000B35000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing