remcos | ddf8299e0a1e35d69a3a0157d5238d754c60e6d1acc944da7345868a9fac2fa6

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-en-20210920
submitted
27/10/2021, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_102521 Receipt Document,pdf.exe
Size 1.0MB
Sample211027-mbebvabff3
SHA256 ddf8299e0a1e35d69a3a0157d5238d754c60e6d1acc944da7345868a9fac2fa6
MD5 c97946822bc09386452975b735456654
SHA1 fa17f8ccd7e96ee1e05b7fa2a67f224801655417
SHA512 aafb5f081aa3344b2c238f4786235c0ddb1e08f73324ac8b8266bf0defab65485bd73a4470e8c2098d7260235d902e3001469ea52cedfa346553c15ad574ce62
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ufccwf = "C:\\Users\\Public\\Libraries\\\\fwccfU.url"	DHL_102521 Receipt Document,pdf.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1164	reg.exe
940	reg.exe
1676	reg.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1048	1108	DHL_102521 Receipt Document,pdf.exe	30
PID 1108 wrote to memory of 1068	1108	DHL_102521 Receipt Document,pdf.exe	31
PID 1108 wrote to memory of 1068	1108	DHL_102521 Receipt Document,pdf.exe	31
PID 1108 wrote to memory of 1068	1108	DHL_102521 Receipt Document,pdf.exe	31
PID 1108 wrote to memory of 1068	1108	DHL_102521 Receipt Document,pdf.exe	31
PID 1068 wrote to memory of 1912	1068	cmd.exe	34
PID 1068 wrote to memory of 1912	1068	cmd.exe	34
PID 1068 wrote to memory of 1912	1068	cmd.exe	34
PID 1068 wrote to memory of 1912	1068	cmd.exe	34
PID 1912 wrote to memory of 1164	1912	cmd.exe	35
PID 1912 wrote to memory of 1164	1912	cmd.exe	35
PID 1912 wrote to memory of 1164	1912	cmd.exe	35
PID 1912 wrote to memory of 1164	1912	cmd.exe	35
PID 1912 wrote to memory of 940	1912	cmd.exe	36
PID 1912 wrote to memory of 940	1912	cmd.exe	36
PID 1912 wrote to memory of 940	1912	cmd.exe	36
PID 1912 wrote to memory of 940	1912	cmd.exe	36
PID 1912 wrote to memory of 1960	1912	cmd.exe	37
PID 1912 wrote to memory of 1960	1912	cmd.exe	37
PID 1912 wrote to memory of 1960	1912	cmd.exe	37
PID 1912 wrote to memory of 1960	1912	cmd.exe	37
PID 1108 wrote to memory of 596	1108	DHL_102521 Receipt Document,pdf.exe	38
PID 1108 wrote to memory of 596	1108	DHL_102521 Receipt Document,pdf.exe	38
PID 1108 wrote to memory of 596	1108	DHL_102521 Receipt Document,pdf.exe	38
PID 1108 wrote to memory of 596	1108	DHL_102521 Receipt Document,pdf.exe	38
PID 596 wrote to memory of 1676	596	cmd.exe	40
PID 596 wrote to memory of 1676	596	cmd.exe	40
PID 596 wrote to memory of 1676	596	cmd.exe	40
PID 596 wrote to memory of 1676	596	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\DHL_102521 Receipt Document,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_102521 Receipt Document,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  PID:1048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:1164
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:940
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-72-0x00000000000C0000-0x00000000000C1000-memory.dmp

Download

memory/1048-74-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/1048-73-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/1048-57-0x00000000000C0000-0x00000000000C1000-memory.dmp

Download

memory/1048-67-0x0000000072600000-0x000000007267C000-memory.dmp

Download

memory/1108-54-0x00000000765A1000-0x00000000765A3000-memory.dmp

Download

memory/1108-56-0x0000000000311000-0x0000000000325000-memory.dmp

Download

memory/1108-55-0x0000000000230000-0x0000000000231000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads