remcos | 98e5d25243d03b80cc83c955796c42b39f308f55102a9ec01d0f308e06b4cfa9

General

Target

Statement of Account April-2021.exe
Size

1.4MB
MD5

384e5af70000fb658251d79ddf8e8878
SHA1

a2bafce0284f457eafd3dcbed73adeb84ed762df
SHA256

98e5d25243d03b80cc83c955796c42b39f308f55102a9ec01d0f308e06b4cfa9
SHA512

28ebd09467fa0781dc3c8a33ea24cb642ecfbcd56fd859c74590773147a45861752446501afc83e441d90507509de4b2b707a5e9b96531ae3a0358ed1ec76e9a

Score

10^/10

remcos agilenet rat

Malware Config

Extracted

Family

remcos

C2

45.137.22.107:5888

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

3956 svchost.exe

pid	process
3956	svchost.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4064-122-0x0000000006A80000-0x0000000006AA1000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

Statement of Account April-2021.exe

description pid process target process

PID 4064 set thread context of 3956 4064 Statement of Account April-2021.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Statement of Account April-2021.exe

pid process

4064 Statement of Account April-2021.exe
4064 Statement of Account April-2021.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Statement of Account April-2021.exe

description pid process

Token: SeDebugPrivilege 4064 Statement of Account April-2021.exe

description	pid	process	target process
PID 4064 set thread context of 3956	4064	Statement of Account April-2021.exe	svchost.exe

pid	process
4064	Statement of Account April-2021.exe
4064	Statement of Account April-2021.exe

description	pid	process
Token: SeDebugPrivilege	4064	Statement of Account April-2021.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Statement of Account April-2021.exe

description	pid	process	target process
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe
PID 4064 wrote to memory of 3956	4064	Statement of Account April-2021.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Statement of Account April-2021.exe
"C:\Users\Admin\AppData\Local\Temp\Statement of Account April-2021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Executes dropped EXE
PID:3956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6bdb3091562e7dd2c877472286b6cc46

SHA1
122ecbb7a23dc98c61f319cfb060f3cbd407db89

SHA256
87e4144b3f50e9a0635ea6a887a20ef0d7b1321a79793f9fa965b8defbdef698

SHA512
219d646d5d514c705f801cacc736ca1027613d6612c1d30a8d4156143f5344b125a297080926912e7abf94a09b80cae157ac44773e84dd95946a9feb44b10e94

Download Submit
memory/3956-128-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3956-133-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3956-129-0x000000000042EEEF-mapping.dmp

Download
memory/4064-119-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/4064-120-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/4064-122-0x0000000006A80000-0x0000000006AA1000-memory.dmp

Filesize
132KB

Download
memory/4064-123-0x0000000006B30000-0x0000000006B31000-memory.dmp

Filesize
4KB

Download
memory/4064-124-0x0000000006A40000-0x0000000006A41000-memory.dmp

Filesize
4KB

Download
memory/4064-125-0x00000000056A1000-0x00000000056A2000-memory.dmp

Filesize
4KB

Download
memory/4064-126-0x00000000067B0000-0x00000000067BB000-memory.dmp

Filesize
44KB

Download
memory/4064-127-0x0000000009850000-0x0000000009851000-memory.dmp

Filesize
4KB

Download
memory/4064-114-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/4064-118-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/4064-117-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

Filesize
4KB

Download
memory/4064-116-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing