remcos | 0b7eaab988ec406ce0b6df31d9abdc68e535c529c6ac5b5a5c9deb4e4fbe6611

General

Target

0fbceb4a8af5ab7e3267616253254d75.exe
Size

1.4MB
MD5

ccc2e680bdf80b7037b28a20baab2d99
SHA1

ae83ff5f0c48c1848a06b5ed247119380907446f
SHA256

0b7eaab988ec406ce0b6df31d9abdc68e535c529c6ac5b5a5c9deb4e4fbe6611
SHA512

1eda3dc6d2e2b045bd275ca061e870a440560bf64da43d35c23be24bea85f09f6c568659aa12ae7a03e815bd171a03747c8aefedbfd4dd0056d0a229e2c6def2

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

sandshoe.myfirewall.org:2404

sandshoe.myfirewall.org:2415

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

svchosts.exesvchosts.exe

pid process

2384 svchosts.exe
1688 svchosts.exe

pid	process
2384	svchosts.exe
1688	svchosts.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0fbceb4a8af5ab7e3267616253254d75.exesvchosts.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	0fbceb4a8af5ab7e3267616253254d75.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\svchosts.exe\""	0fbceb4a8af5ab7e3267616253254d75.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	svchosts.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\svchosts.exe\""	svchosts.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

0fbceb4a8af5ab7e3267616253254d75.exesvchosts.exe

description	pid	process	target process
PID 1908 set thread context of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 2384 set thread context of 1688	2384	svchosts.exe	svchosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

0fbceb4a8af5ab7e3267616253254d75.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	0fbceb4a8af5ab7e3267616253254d75.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

0fbceb4a8af5ab7e3267616253254d75.exesvchosts.exe

pid	process
1908	0fbceb4a8af5ab7e3267616253254d75.exe
1908	0fbceb4a8af5ab7e3267616253254d75.exe
1908	0fbceb4a8af5ab7e3267616253254d75.exe
1908	0fbceb4a8af5ab7e3267616253254d75.exe
1908	0fbceb4a8af5ab7e3267616253254d75.exe
2384	svchosts.exe
2384	svchosts.exe
2384	svchosts.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0fbceb4a8af5ab7e3267616253254d75.exesvchosts.exe

description pid process

Token: SeDebugPrivilege 1908 0fbceb4a8af5ab7e3267616253254d75.exe
Token: SeDebugPrivilege 2384 svchosts.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchosts.exe

pid process

1688 svchosts.exe

description	pid	process
Token: SeDebugPrivilege	1908	0fbceb4a8af5ab7e3267616253254d75.exe
Token: SeDebugPrivilege	2384	svchosts.exe

pid	process
1688	svchosts.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

0fbceb4a8af5ab7e3267616253254d75.exe0fbceb4a8af5ab7e3267616253254d75.exeWScript.execmd.exesvchosts.exesvchosts.exe

description	pid	process	target process
PID 1908 wrote to memory of 3264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 3264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 3264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1908 wrote to memory of 1264	1908	0fbceb4a8af5ab7e3267616253254d75.exe	0fbceb4a8af5ab7e3267616253254d75.exe
PID 1264 wrote to memory of 3928	1264	0fbceb4a8af5ab7e3267616253254d75.exe	WScript.exe
PID 1264 wrote to memory of 3928	1264	0fbceb4a8af5ab7e3267616253254d75.exe	WScript.exe
PID 1264 wrote to memory of 3928	1264	0fbceb4a8af5ab7e3267616253254d75.exe	WScript.exe
PID 3928 wrote to memory of 924	3928	WScript.exe	cmd.exe
PID 3928 wrote to memory of 924	3928	WScript.exe	cmd.exe
PID 3928 wrote to memory of 924	3928	WScript.exe	cmd.exe
PID 924 wrote to memory of 2384	924	cmd.exe	svchosts.exe
PID 924 wrote to memory of 2384	924	cmd.exe	svchosts.exe
PID 924 wrote to memory of 2384	924	cmd.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 2384 wrote to memory of 1688	2384	svchosts.exe	svchosts.exe
PID 1688 wrote to memory of 3516	1688	svchosts.exe	svchost.exe
PID 1688 wrote to memory of 3516	1688	svchosts.exe	svchost.exe
PID 1688 wrote to memory of 3516	1688	svchosts.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\0fbceb4a8af5ab7e3267616253254d75.exe
"C:\Users\Admin\AppData\Local\Temp\0fbceb4a8af5ab7e3267616253254d75.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\0fbceb4a8af5ab7e3267616253254d75.exe
"{path}"
2⤵
PID:3264

C:\Users\Admin\AppData\Local\Temp\0fbceb4a8af5ab7e3267616253254d75.exe
"{path}"
2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\svchosts.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:924

C:\Users\Admin\AppData\Roaming\Remcos\svchosts.exe
C:\Users\Admin\AppData\Roaming\Remcos\svchosts.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384

C:\Users\Admin\AppData\Roaming\Remcos\svchosts.exe
"{path}"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
7⤵
PID:3516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
57c7d195a177757bfcf67886fd7c170c

SHA1
64187068dae395acd2bed9dd6c42d10bddebaa98

SHA256
35780c2a4ec8203bb8fce796654f77d441ff9196851ccea72f9c207b22f51382

SHA512
270f1fffa624530ba45c2bd6b55e66b2a07680331f85d9f0d2d2502f9bd2bac83f92fdf968dd05170a9c02d38783fb8bef0b484f28f1c919680ec6ab3c324d7b

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\svchosts.exe
MD5
ccc2e680bdf80b7037b28a20baab2d99

SHA1
ae83ff5f0c48c1848a06b5ed247119380907446f

SHA256
0b7eaab988ec406ce0b6df31d9abdc68e535c529c6ac5b5a5c9deb4e4fbe6611

SHA512
1eda3dc6d2e2b045bd275ca061e870a440560bf64da43d35c23be24bea85f09f6c568659aa12ae7a03e815bd171a03747c8aefedbfd4dd0056d0a229e2c6def2

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\svchosts.exe
MD5
ccc2e680bdf80b7037b28a20baab2d99

SHA1
ae83ff5f0c48c1848a06b5ed247119380907446f

SHA256
0b7eaab988ec406ce0b6df31d9abdc68e535c529c6ac5b5a5c9deb4e4fbe6611

SHA512
1eda3dc6d2e2b045bd275ca061e870a440560bf64da43d35c23be24bea85f09f6c568659aa12ae7a03e815bd171a03747c8aefedbfd4dd0056d0a229e2c6def2

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\svchosts.exe
MD5
ccc2e680bdf80b7037b28a20baab2d99

SHA1
ae83ff5f0c48c1848a06b5ed247119380907446f

SHA256
0b7eaab988ec406ce0b6df31d9abdc68e535c529c6ac5b5a5c9deb4e4fbe6611

SHA512
1eda3dc6d2e2b045bd275ca061e870a440560bf64da43d35c23be24bea85f09f6c568659aa12ae7a03e815bd171a03747c8aefedbfd4dd0056d0a229e2c6def2

Download Submit
memory/924-130-0x0000000000000000-mapping.dmp

Download
memory/1264-125-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1264-126-0x0000000000413FA4-mapping.dmp

Download
memory/1264-129-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1688-148-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1688-146-0x0000000000413FA4-mapping.dmp

Download
memory/1908-114-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/1908-121-0x000000000BCB0000-0x000000000BCB1000-memory.dmp

Filesize
4KB

Download
memory/1908-120-0x0000000001890000-0x0000000001891000-memory.dmp

Filesize
4KB

Download
memory/1908-124-0x0000000006070000-0x00000000060AA000-memory.dmp

Filesize
232KB

Download
memory/1908-119-0x0000000008A30000-0x0000000008A31000-memory.dmp

Filesize
4KB

Download
memory/1908-118-0x0000000008040000-0x0000000008041000-memory.dmp

Filesize
4KB

Download
memory/1908-117-0x0000000007FA0000-0x0000000007FA1000-memory.dmp

Filesize
4KB

Download
memory/1908-123-0x0000000005A00000-0x0000000005A83000-memory.dmp

Filesize
524KB

Download
memory/1908-116-0x00000000083C0000-0x00000000083C1000-memory.dmp

Filesize
4KB

Download
memory/1908-122-0x00000000018C0000-0x00000000018CE000-memory.dmp

Filesize
56KB

Download
memory/2384-131-0x0000000000000000-mapping.dmp

Download
memory/2384-140-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/3928-127-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads