remcos | a2bbd3bc733fb3addfb364d282edcb686292889b5850fa3c913ddc287745ed4e

Analysis

max time kernel
149s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
14/05/2021, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nuevo pedido _WJO-001,pdf.exe
Size 560KB
Sample210514-d19qn2v5d2
SHA256 a2bbd3bc733fb3addfb364d282edcb686292889b5850fa3c913ddc287745ed4e
MD5 1f30cac348c3eac121f8a248555fccdd
SHA1 c46d28055716abf401071ec39ea2d8db477ea1f1
SHA512 f6f42a29e16f26690f235d66fdccb45b5f4a68b375b195a750223315b3adc54f9cda1072d8609e2f0a9ec7bffee5563b9e5db180f31b3b6e777bcbea5365fe10
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

poiarmex247.ddns.net:8634

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
3208	Netplwiz.exe

Loads dropped DLL 1 IoCs

pid	Process
3208	Netplwiz.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xcopos = "C:\\Users\\Public\\sopocX.url"	Nuevo pedido _WJO-001,pdf.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1832	powershell.exe
1832	powershell.exe
1832	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3104	secinit.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeIncreaseQuotaPrivilege	1832	powershell.exe
Token: SeSecurityPrivilege	1832	powershell.exe
Token: SeTakeOwnershipPrivilege	1832	powershell.exe
Token: SeLoadDriverPrivilege	1832	powershell.exe
Token: SeSystemProfilePrivilege	1832	powershell.exe
Token: SeSystemtimePrivilege	1832	powershell.exe
Token: SeProfSingleProcessPrivilege	1832	powershell.exe
Token: SeIncBasePriorityPrivilege	1832	powershell.exe
Token: SeCreatePagefilePrivilege	1832	powershell.exe
Token: SeBackupPrivilege	1832	powershell.exe
Token: SeRestorePrivilege	1832	powershell.exe
Token: SeShutdownPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeSystemEnvironmentPrivilege	1832	powershell.exe
Token: SeRemoteShutdownPrivilege	1832	powershell.exe
Token: SeUndockPrivilege	1832	powershell.exe
Token: SeManageVolumePrivilege	1832	powershell.exe
Token: 33	1832	powershell.exe
Token: 34	1832	powershell.exe
Token: 35	1832	powershell.exe
Token: 36	1832	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 3104	3952	Nuevo pedido _WJO-001,pdf.exe	78
PID 3952 wrote to memory of 1428	3952	Nuevo pedido _WJO-001,pdf.exe	79
PID 3952 wrote to memory of 1428	3952	Nuevo pedido _WJO-001,pdf.exe	79
PID 3952 wrote to memory of 1428	3952	Nuevo pedido _WJO-001,pdf.exe	79
PID 1428 wrote to memory of 1264	1428	cmd.exe	81
PID 1428 wrote to memory of 1264	1428	cmd.exe	81
PID 1428 wrote to memory of 1264	1428	cmd.exe	81
PID 1264 wrote to memory of 3208	1264	cmd.exe	83
PID 1264 wrote to memory of 3208	1264	cmd.exe	83
PID 3208 wrote to memory of 628	3208	Netplwiz.exe	84
PID 3208 wrote to memory of 628	3208	Netplwiz.exe	84
PID 628 wrote to memory of 1832	628	cmd.exe	86
PID 628 wrote to memory of 1832	628	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\Nuevo pedido _WJO-001,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Nuevo pedido _WJO-001,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\secinit.exe
  C:\Windows\System32\secinit.exe
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\stt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\PXOR.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows \System32\Netplwiz.exe
      "C:\Windows \System32\Netplwiz.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Public\Cdex.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:628
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-142-0x0000023626510000-0x0000023626512000-memory.dmp

Download

memory/1832-173-0x0000023626513000-0x0000023626515000-memory.dmp

Download

memory/1832-174-0x0000023626516000-0x0000023626518000-memory.dmp

Download

memory/1832-150-0x00000236287F0000-0x00000236287F1000-memory.dmp

Download

memory/1832-145-0x000002360E2E0000-0x000002360E2E1000-memory.dmp

Download

memory/3104-133-0x0000000002D60000-0x0000000002D61000-memory.dmp

Download

memory/3104-138-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Download

memory/3104-140-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/3104-141-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3104-134-0x0000000002C60000-0x0000000002C61000-memory.dmp

Download

memory/3952-116-0x0000000000770000-0x000000000078A000-memory.dmp

Download

memory/3952-114-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download