remcos | f74e5e77ee6f64654fb912f76a8b5095d783bf3af22dea186ef7b5730c4a868e

Analysis

max time kernel
150s
max time network
154s
platform
windows10_x64
resource
win10v20210408
submitted
16/07/2021, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_119040 receipt document,pdf.exe
Size 573KB
Sample210716-11xkdpd3ls
SHA256 f74e5e77ee6f64654fb912f76a8b5095d783bf3af22dea186ef7b5730c4a868e
MD5 c7e64e550b0b6590c99586cef7a7271f
SHA1 2f8a1775e7b84cad502dccba6ae132a470093384
SHA512 37a92162c37467ff7e3efa9ca715409a8d5ab77ea783b9271158c031ac6a92ac2e0e4c52078f8f7ba305d35548273ac2533c39153fc692d20540a512e3c83855
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ckbevvj = "C:\\Users\\Public\\Libraries\\jvvebkC.url"	DHL_119040 receipt document,pdf.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78
PID 568 wrote to memory of 2300	568	DHL_119040 receipt document,pdf.exe	78

C:\Users\Admin\AppData\Local\Temp\DHL_119040 receipt document,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_119040 receipt document,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  PID:2300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-114-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/568-117-0x00000000006A0000-0x00000000006BA000-memory.dmp

Download

memory/2300-121-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/2300-120-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/2300-123-0x00000000004C0000-0x00000000004C1000-memory.dmp

Download

memory/2300-122-0x0000000010590000-0x000000001060D000-memory.dmp

Download

memory/2300-124-0x0000000000800000-0x0000000000867000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads