remcos | f4dcc52b899bbe0d34ffbb44032c0186953c174beaf647c0556c7e71385c6bb4

General

Target

94280a43_by_Libranalysis.exe
Size

957KB
MD5

94280a43fd855f2a592d30c6e1d4253b
SHA1

8a57b7856a398066d7d830072f88b6f7fa4e96fa
SHA256

f4dcc52b899bbe0d34ffbb44032c0186953c174beaf647c0556c7e71385c6bb4
SHA512

8e5e064f9ae4d4c7826870a6e4c36a8d12b4b260fefcfc235e88101feb0bcafcf815d98fc298dc1e34985b754f42f7b446ec88e2b4dfe389d7ba6aec684a8361

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

luckymanoffavour.ddns.net:5405

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

94280a43_by_Libranalysis.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ahdkje = "C:\\Users\\Public\\ejkdhA.url"	94280a43_by_Libranalysis.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

94280a43_by_Libranalysis.exe

description	pid	process	target process
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe
PID 584 wrote to memory of 1264	584	94280a43_by_Libranalysis.exe	secinit.exe

C:\Users\Admin\AppData\Local\Temp\94280a43_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\94280a43_by_Libranalysis.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\secinit.exe
C:\Windows\System32\secinit.exe
2⤵
PID:1264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-114-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/584-116-0x0000000003D70000-0x0000000003D8A000-memory.dmp

Filesize
104KB

Download
memory/1264-119-0x0000000000000000-mapping.dmp

Download
memory/1264-121-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/1264-120-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/1264-123-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/1264-125-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1264-124-0x0000000010590000-0x000000001060B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing