remcos | 3f62a232dcf82e5678614dafedd81b8663ccc2e7fb556ba2bcf04dddb1115369

General

Target

Shipment Document BL,INV and packing list.jpg.exe
Size

1.6MB
MD5

672cc6ba8db2c80b6e0b8bfbd94f5eb0
SHA1

7d0dcda440b2ad736514c27f3b445ae8e4ae6c38
SHA256

59c5657e3e6221b1066f4e39fc36625fd84566cad13702e1e159453e27b93f41
SHA512

cfff8f8e5f6f5549729ec3fa2082a9c26ba322b289b132a5cb17f1c3b9cd4f5c4d326c167d285c2364eb442fda72e3114245a8acfc89699ca92f9d03fe1237d2

Score

10^/10

remcos host persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

194.5.97.32:5890

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_oqkhxjzletgovfx
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 3 IoCs

Processes:

remcos.exeremcos.exeremcos.exe

pid process

1720 remcos.exe
932 remcos.exe
604 remcos.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1448 cmd.exe

pid	process
1720	remcos.exe
932	remcos.exe
604	remcos.exe

pid	process
1448	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

remcos.exeShipment Document BL,INV and packing list.jpg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Shipment Document BL,INV and packing list.jpg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	Shipment Document BL,INV and packing list.jpg.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Shipment Document BL,INV and packing list.jpg.exeremcos.exeremcos.exe

description	pid	process	target process
PID 1052 set thread context of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1720 set thread context of 604	1720	remcos.exe	remcos.exe
PID 604 set thread context of 2040	604	remcos.exe	iexplore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

904 timeout.exe
1492 timeout.exe

pid	process
904	timeout.exe
1492	timeout.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec000000000020000000000106600000001000020000000657e3dcf7910966da3e99523ee96177dd40bf08277cb7f1bd09e656e5d386495000000000e8000000002000020000000207d9c82ce982c54600a755b6ce95f8160a69e4c2eb7b996090113815a80ac129000000093668e3daf3f1caa6455745967fd0de83411afb111a89a181740bc717b2174cbdc46e08f97bb8bb912f5d06d03fb8489a3392724325e43834b88619ba582681b7297d9605eafdaa696e804b8a35c9c5fabc1146fb0d62c584a1deb490e47f20a67755a4b28d47736efcd37cccd5e45ebbded9e1398149fc139ff5bb93a34ed07bef40ece347dba78816cbf9ea2c7af4d400000009f2483e6cf6c6eb799eef93904dbfc1644e3a63df59c4472970c84c794053b77c00d0949f4065afc5057dace14879f3df9c357ee1b7dccec03476ab1ea046870	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec0000000000200000000001066000000010000200000001fe077fdbb7477eadcc36ead792fcdd7f9a60423eeefe4c75a76c7f48f319e7d000000000e80000000020000200000002875d4348191b8589d8166defd061d33d30293d9bb53e518720df7cad2fbd4dd200000007b50254ff16f40ea439af10ca0327cf52d7dd0bd4854a89c47a646e5128e67314000000076fdbec0b590c9d171a32bd90699209aaec4f125b93bf9a0a19a39b4e337928ed939f4597371da96b26fa83a98104f7a15acb8118c032843e358bce812ca4dd1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67EC3231-D297-11EC-A814-FABB0CD78C51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09c4144a466d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1888 PING.EXE

pid	process
1888	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exeShipment Document BL,INV and packing list.jpg.exepowershell.exeremcos.exe

pid	process
1608	powershell.exe
1052	Shipment Document BL,INV and packing list.jpg.exe
1052	Shipment Document BL,INV and packing list.jpg.exe
1052	Shipment Document BL,INV and packing list.jpg.exe
1796	powershell.exe
1720	remcos.exe
1720	remcos.exe
1720	remcos.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exeShipment Document BL,INV and packing list.jpg.exepowershell.exeremcos.exe

description	pid	process
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	1052	Shipment Document BL,INV and packing list.jpg.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	1720	remcos.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1016 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1016 iexplore.exe
1016 iexplore.exe
1580 IEXPLORE.EXE
1580 IEXPLORE.EXE
1580 IEXPLORE.EXE
1580 IEXPLORE.EXE

pid	process
1016	iexplore.exe

pid	process
1016	iexplore.exe
1016	iexplore.exe
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Shipment Document BL,INV and packing list.jpg.execmd.exeShipment Document BL,INV and packing list.jpg.execmd.exeremcos.execmd.exe

description	pid	process	target process
PID 1052 wrote to memory of 1608	1052	Shipment Document BL,INV and packing list.jpg.exe	powershell.exe
PID 1052 wrote to memory of 1608	1052	Shipment Document BL,INV and packing list.jpg.exe	powershell.exe
PID 1052 wrote to memory of 1608	1052	Shipment Document BL,INV and packing list.jpg.exe	powershell.exe
PID 1052 wrote to memory of 1608	1052	Shipment Document BL,INV and packing list.jpg.exe	powershell.exe
PID 1052 wrote to memory of 1940	1052	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1052 wrote to memory of 1940	1052	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1052 wrote to memory of 1940	1052	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1052 wrote to memory of 1940	1052	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1940 wrote to memory of 1492	1940	cmd.exe	timeout.exe
PID 1940 wrote to memory of 1492	1940	cmd.exe	timeout.exe
PID 1940 wrote to memory of 1492	1940	cmd.exe	timeout.exe
PID 1940 wrote to memory of 1492	1940	cmd.exe	timeout.exe
PID 1052 wrote to memory of 1452	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1452	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1452	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1452	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1052 wrote to memory of 1420	1052	Shipment Document BL,INV and packing list.jpg.exe	Shipment Document BL,INV and packing list.jpg.exe
PID 1420 wrote to memory of 1448	1420	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1420 wrote to memory of 1448	1420	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1420 wrote to memory of 1448	1420	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1420 wrote to memory of 1448	1420	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1420 wrote to memory of 1448	1420	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1420 wrote to memory of 1448	1420	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1420 wrote to memory of 1448	1420	Shipment Document BL,INV and packing list.jpg.exe	cmd.exe
PID 1448 wrote to memory of 1888	1448	cmd.exe	PING.EXE
PID 1448 wrote to memory of 1888	1448	cmd.exe	PING.EXE
PID 1448 wrote to memory of 1888	1448	cmd.exe	PING.EXE
PID 1448 wrote to memory of 1888	1448	cmd.exe	PING.EXE
PID 1448 wrote to memory of 1720	1448	cmd.exe	remcos.exe
PID 1448 wrote to memory of 1720	1448	cmd.exe	remcos.exe
PID 1448 wrote to memory of 1720	1448	cmd.exe	remcos.exe
PID 1448 wrote to memory of 1720	1448	cmd.exe	remcos.exe
PID 1720 wrote to memory of 1796	1720	remcos.exe	powershell.exe
PID 1720 wrote to memory of 1796	1720	remcos.exe	powershell.exe
PID 1720 wrote to memory of 1796	1720	remcos.exe	powershell.exe
PID 1720 wrote to memory of 1796	1720	remcos.exe	powershell.exe
PID 1720 wrote to memory of 768	1720	remcos.exe	cmd.exe
PID 1720 wrote to memory of 768	1720	remcos.exe	cmd.exe
PID 1720 wrote to memory of 768	1720	remcos.exe	cmd.exe
PID 1720 wrote to memory of 768	1720	remcos.exe	cmd.exe
PID 768 wrote to memory of 904	768	cmd.exe	timeout.exe
PID 768 wrote to memory of 904	768	cmd.exe	timeout.exe
PID 768 wrote to memory of 904	768	cmd.exe	timeout.exe
PID 768 wrote to memory of 904	768	cmd.exe	timeout.exe
PID 1720 wrote to memory of 932	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 932	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 932	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 932	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 604	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 604	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 604	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 604	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 604	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 604	1720	remcos.exe	remcos.exe
PID 1720 wrote to memory of 604	1720	remcos.exe	remcos.exe

C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AEEAcgB0AC0AUwBsAEUAZQBQACAALQBzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 20
2⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\timeout.exe
timeout 20
3⤵
- Delays execution with timeout.exe
PID:1492

C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"
2⤵
PID:1452

C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:1888

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AEEAcgB0AC0AUwBsAEUAZQBQACAALQBzACAAMgAwAA==
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 20
5⤵
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\timeout.exe
timeout 20
6⤵
- Delays execution with timeout.exe
PID:904

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
5⤵
- Executes dropped EXE
PID:932

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:604

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
6⤵
PID:2040

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
7⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1016

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:275457 /prefetch:2
8⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9os4y76\imagestore.dat
Filesize
21KB

MD5
20ea40a5c53ce84724b44128ba221023

SHA1
bae0b2094d0e62df0cc0a90a64bc278b02056392

SHA256
0c943d2908ed1501497dfb04a56ccc42727bcf33fa035ed07dd66de1f1728a0d

SHA512
d6116dd052f6323e5f3e2838d149fce5a2391ecfeda89a60efc3d1defef64a076e0db7e438da673da49bf51f72c7122f9a38e9d2869de27aaa3998da54273dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat
Filesize
99B

MD5
76c1687d97dfdbcea62ef1490bec5001

SHA1
5f4d1aeafa7d840cde67b76f97416dd68efd1bed

SHA256
79f04ea049979ffd2232c459fdd57fae97a5255aea9b4a2c7dce7ead856f37a4

SHA512
da250f0628632a644f159d818a82a8b9cca8224e46843bddbe0f6f9c32a2d04f7736a620af49ab6d77616317ca7d68285e60043965fe86c03d940835bd30a925

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
6a623cb53e9ae27591e78802889c0c87

SHA1
be7ab14598d52a797dd306ff9f93485ffd547259

SHA256
ed65fe2264ef90e9e86abea1099574d002e347d6e1d0c16430538911c2d6551f

SHA512
72181d0e770704b5606dd91836bbd4042d4cf776efb46c53f85eb4924bf1c1b4c3fdcc857ab596a6c0c5aa9901b3a251cdc7c58282341ebd16a29cd5bc6d7356

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Filesize
1.6MB

MD5
672cc6ba8db2c80b6e0b8bfbd94f5eb0

SHA1
7d0dcda440b2ad736514c27f3b445ae8e4ae6c38

SHA256
59c5657e3e6221b1066f4e39fc36625fd84566cad13702e1e159453e27b93f41

SHA512
cfff8f8e5f6f5549729ec3fa2082a9c26ba322b289b132a5cb17f1c3b9cd4f5c4d326c167d285c2364eb442fda72e3114245a8acfc89699ca92f9d03fe1237d2

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Filesize
1.6MB

MD5
672cc6ba8db2c80b6e0b8bfbd94f5eb0

SHA1
7d0dcda440b2ad736514c27f3b445ae8e4ae6c38

SHA256
59c5657e3e6221b1066f4e39fc36625fd84566cad13702e1e159453e27b93f41

SHA512
cfff8f8e5f6f5549729ec3fa2082a9c26ba322b289b132a5cb17f1c3b9cd4f5c4d326c167d285c2364eb442fda72e3114245a8acfc89699ca92f9d03fe1237d2

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Filesize
1.6MB

MD5
672cc6ba8db2c80b6e0b8bfbd94f5eb0

SHA1
7d0dcda440b2ad736514c27f3b445ae8e4ae6c38

SHA256
59c5657e3e6221b1066f4e39fc36625fd84566cad13702e1e159453e27b93f41

SHA512
cfff8f8e5f6f5549729ec3fa2082a9c26ba322b289b132a5cb17f1c3b9cd4f5c4d326c167d285c2364eb442fda72e3114245a8acfc89699ca92f9d03fe1237d2

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
Filesize
1.6MB

MD5
672cc6ba8db2c80b6e0b8bfbd94f5eb0

SHA1
7d0dcda440b2ad736514c27f3b445ae8e4ae6c38

SHA256
59c5657e3e6221b1066f4e39fc36625fd84566cad13702e1e159453e27b93f41

SHA512
cfff8f8e5f6f5549729ec3fa2082a9c26ba322b289b132a5cb17f1c3b9cd4f5c4d326c167d285c2364eb442fda72e3114245a8acfc89699ca92f9d03fe1237d2

Download Submit
\Users\Admin\AppData\Roaming\remcos\remcos.exe
Filesize
1.6MB

MD5
672cc6ba8db2c80b6e0b8bfbd94f5eb0

SHA1
7d0dcda440b2ad736514c27f3b445ae8e4ae6c38

SHA256
59c5657e3e6221b1066f4e39fc36625fd84566cad13702e1e159453e27b93f41

SHA512
cfff8f8e5f6f5549729ec3fa2082a9c26ba322b289b132a5cb17f1c3b9cd4f5c4d326c167d285c2364eb442fda72e3114245a8acfc89699ca92f9d03fe1237d2

Download Submit
memory/604-106-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/604-101-0x000000000040FD88-mapping.dmp

Download
memory/604-105-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/768-89-0x0000000000000000-mapping.dmp

Download
memory/904-90-0x0000000000000000-mapping.dmp

Download
memory/1052-54-0x0000000001360000-0x00000000014F8000-memory.dmp

Filesize
1.6MB

Download
memory/1052-62-0x0000000004910000-0x0000000004944000-memory.dmp

Filesize
208KB

Download
memory/1052-59-0x00000000053C0000-0x000000000554E000-memory.dmp

Filesize
1.6MB

Download
memory/1052-55-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/1420-64-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1420-66-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1420-74-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1420-76-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1420-71-0x000000000040FD88-mapping.dmp

Download
memory/1420-70-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1420-63-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1420-69-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1420-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1448-75-0x0000000000000000-mapping.dmp

Download
memory/1492-61-0x0000000000000000-mapping.dmp

Download
memory/1608-56-0x0000000000000000-mapping.dmp

Download
memory/1608-58-0x0000000071870000-0x0000000071E1B000-memory.dmp

Filesize
5.7MB

Download
memory/1720-81-0x0000000000000000-mapping.dmp

Download
memory/1720-91-0x0000000004810000-0x0000000004844000-memory.dmp

Filesize
208KB

Download
memory/1720-83-0x0000000000180000-0x0000000000318000-memory.dmp

Filesize
1.6MB

Download
memory/1796-88-0x0000000072B00000-0x00000000730AB000-memory.dmp

Filesize
5.7MB

Download
memory/1796-85-0x0000000000000000-mapping.dmp

Download
memory/1888-78-0x0000000000000000-mapping.dmp

Download
memory/1940-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads