remcos | 4f821cf509cfc60d0e9d0f4740f1115a985b9771727199b12b1c5f115e79fbbf

General

Target

P.O 2019 Autopromotec Exhibition.exe
Size

359KB
MD5

d7763969d2edcc2339e3f94c08a1894f
SHA1

eff704bd0c21bde634bcf85c5d9ccdb76187d7a4
SHA256

97c985b33dbd9ee5c3541f3299abe1c0131ba2f5234ce01ee0dc1dbb1039aa0d
SHA512

ea36f01f76d32dac87987f7b75f4680b3caba29ff8d5f19e99f439c85ba12e6b0ab40c63478910739ffc9706029171180c1fd551a4648937855be74c94c87727

Score

10^/10

remcos remotehost coreentity rat rezer0

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

RemoteHost

C2

servr.killifabuse1.xyz:8643

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-52ZHKH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1320-56-0x0000000000220000-0x0000000000228000-memory.dmp	coreentity

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

CoreCCC Packer 1 IoCs

Detects CoreCCC packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral1/memory/1320-54-0x00000000013D0000-0x0000000001430000-memory.dmp	coreccc

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1320-57-0x00000000006B0000-0x00000000006DC000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

P.O 2019 Autopromotec Exhibition.exe

description pid process target process

PID 1320 set thread context of 820 1320 P.O 2019 Autopromotec Exhibition.exe P.O 2019 Autopromotec Exhibition.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1268 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

P.O 2019 Autopromotec Exhibition.exe

description pid process

Token: SeDebugPrivilege 1320 P.O 2019 Autopromotec Exhibition.exe

description	pid	process	target process
PID 1320 set thread context of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe

pid	process
1268	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1320	P.O 2019 Autopromotec Exhibition.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

P.O 2019 Autopromotec Exhibition.exe

C:\Users\Admin\AppData\Local\Temp\P.O 2019 Autopromotec Exhibition.exe
"C:\Users\Admin\AppData\Local\Temp\P.O 2019 Autopromotec Exhibition.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ocrzdzGmCaSW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp926.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1268
- C:\Users\Admin\AppData\Local\Temp\P.O 2019 Autopromotec Exhibition.exe
  "{path}"
  2⤵
  PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp926.tmp

Filesize
1KB

MD5
f863e68d6ea932d3ad0fbb58d8a93d70

SHA1
96be027a75f96035060d4ac974930f0b3eaca864

SHA256
01b6ba4f4cc9081549b1b036e8250d71db9aab5776a7feec8dde9a8fb812845b

SHA512
e047301f13ad433854ed5988e90652b1f6c1eea4c1e7d9da02bedc62fd6bcc28b4bc7247bdff38c1e522cedad662b2892866205d5b02ad7f5709566d5f4982f7

Download Submit
memory/820-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/820-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/820-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/820-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/820-70-0x0000000000413A84-mapping.dmp

Download
memory/820-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/820-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/820-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/820-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/820-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1268-58-0x0000000000000000-mapping.dmp

Download
memory/1320-56-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1320-54-0x00000000013D0000-0x0000000001430000-memory.dmp

Filesize
384KB

Download
memory/1320-55-0x0000000075CD1000-0x0000000075CD3000-memory.dmp

Filesize
8KB

Download
memory/1320-57-0x00000000006B0000-0x00000000006DC000-memory.dmp

Filesize
176KB

Download

description	pid	process	target process
PID 1320 wrote to memory of 1268	1320	P.O 2019 Autopromotec Exhibition.exe	schtasks.exe
PID 1320 wrote to memory of 1268	1320	P.O 2019 Autopromotec Exhibition.exe	schtasks.exe
PID 1320 wrote to memory of 1268	1320	P.O 2019 Autopromotec Exhibition.exe	schtasks.exe
PID 1320 wrote to memory of 1268	1320	P.O 2019 Autopromotec Exhibition.exe	schtasks.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe
PID 1320 wrote to memory of 820	1320	P.O 2019 Autopromotec Exhibition.exe	P.O 2019 Autopromotec Exhibition.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads