remcos | 91b4c720f1aab6ec16c72f685e984b0342876ee5e09b593b4bcc6ad2461fd560

General

Target

Proforma Haziran 21052020,pdf.exe
Size

395KB
MD5

e8880257995f8f870b97aa0e6395c6fd
SHA1

134c29a50676ce8472ec8b978e056d6444ebaa16
SHA256

0f2679baa996e2944996f4162bfb2beeaff492e1e15a844fc9b66f60d3411793
SHA512

b2e689b15e1c6079a597c5360b4a30b3527138870456b1f4fe927fb386c6a5e4929c7d96445f97f03d73f4c9559d7bdd0367defc077a225a2faff86a26ea1b70

Score

10^/10

remcos from jah coreentity rat rezer0

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

FROM JAH

C2

newdawn4me.ddns.net:7213

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-4F6INU
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1376-56-0x0000000000370000-0x0000000000378000-memory.dmp	coreentity

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

CoreCCC Packer 1 IoCs

Detects CoreCCC packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral1/memory/1376-54-0x0000000000A30000-0x0000000000A98000-memory.dmp	coreccc

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1376-57-0x00000000006F0000-0x000000000071C000-memory.dmp	rezer0

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

Proforma Haziran 21052020,pdf.exe

description pid process target process

PID 1376 set thread context of 1552 1376 Proforma Haziran 21052020,pdf.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1688 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Proforma Haziran 21052020,pdf.exe

pid process

1376 Proforma Haziran 21052020,pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Proforma Haziran 21052020,pdf.exe

description pid process

Token: SeDebugPrivilege 1376 Proforma Haziran 21052020,pdf.exe

description	pid	process	target process
PID 1376 set thread context of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe

pid	process
1688	schtasks.exe

pid	process
1376	Proforma Haziran 21052020,pdf.exe

description	pid	process
Token: SeDebugPrivilege	1376	Proforma Haziran 21052020,pdf.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Proforma Haziran 21052020,pdf.exe

description	pid	process	target process
PID 1376 wrote to memory of 1688	1376	Proforma Haziran 21052020,pdf.exe	schtasks.exe
PID 1376 wrote to memory of 1688	1376	Proforma Haziran 21052020,pdf.exe	schtasks.exe
PID 1376 wrote to memory of 1688	1376	Proforma Haziran 21052020,pdf.exe	schtasks.exe
PID 1376 wrote to memory of 1688	1376	Proforma Haziran 21052020,pdf.exe	schtasks.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe
PID 1376 wrote to memory of 1552	1376	Proforma Haziran 21052020,pdf.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Proforma Haziran 21052020,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Proforma Haziran 21052020,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\neHBIvjjoyfJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp40A9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "{path}"
  2⤵
  PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp40A9.tmp

Filesize
1KB

MD5
1b6953a423c8e75f5b7cc41133e64265

SHA1
eb02b2238eb0255f0938991e43d59557d163eb8c

SHA256
02399d1561082b5ba2ac7c4e4b1674b1a071b5fed251f34aa436b66c11ff4950

SHA512
9e23678e47d196e7cc83b45da30cf87463b0e6ca76d434936f59653524098a93e17a4fb6ef702dba357d4a72f926845e796e2ba925a8ca22c0573949742ba1b7

Download Submit
memory/1376-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1376-56-0x0000000000370000-0x0000000000378000-memory.dmp

Filesize
32KB

Download
memory/1376-57-0x00000000006F0000-0x000000000071C000-memory.dmp

Filesize
176KB

Download
memory/1376-54-0x0000000000A30000-0x0000000000A98000-memory.dmp

Filesize
416KB

Download
memory/1552-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1552-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1552-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1552-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1552-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1552-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1552-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1552-70-0x0000000000413A84-mapping.dmp

Download
memory/1552-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1552-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1688-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads