1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16

General

Target
d329ca03ea62e3371e4d63f5271124a3.exe
Size 465KB
Sample220720-xa78msffck
SHA256 1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16
MD5 d329ca03ea62e3371e4d63f5271124a3
SHA1 14c329ff4882ef1aedb93e21e18b691a93dc2f5d
SHA512 f96a04fafc9c32fb546ebdd4cefb64672a13f4768ec1a1fccc4495183ffc242d8c5f409ee1332f6c1137f537a8a7daa81a359fe552d42f867a9e8a15ef3f055d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1736	remcos.exe

Loads dropped DLL 2 IoCs

pid	Process
1588	cmd.exe
1588	cmd.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	d329ca03ea62e3371e4d63f5271124a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	d329ca03ea62e3371e4d63f5271124a3.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\	d329ca03ea62e3371e4d63f5271124a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	d329ca03ea62e3371e4d63f5271124a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	remcos.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1664	1428	d329ca03ea62e3371e4d63f5271124a3.exe	28
PID 1428 wrote to memory of 1664	1428	d329ca03ea62e3371e4d63f5271124a3.exe	28
PID 1428 wrote to memory of 1664	1428	d329ca03ea62e3371e4d63f5271124a3.exe	28
PID 1428 wrote to memory of 1664	1428	d329ca03ea62e3371e4d63f5271124a3.exe	28
PID 1664 wrote to memory of 1588	1664	WScript.exe	29
PID 1664 wrote to memory of 1588	1664	WScript.exe	29
PID 1664 wrote to memory of 1588	1664	WScript.exe	29
PID 1664 wrote to memory of 1588	1664	WScript.exe	29
PID 1588 wrote to memory of 1736	1588	cmd.exe	31
PID 1588 wrote to memory of 1736	1588	cmd.exe	31
PID 1588 wrote to memory of 1736	1588	cmd.exe	31
PID 1588 wrote to memory of 1736	1588	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\d329ca03ea62e3371e4d63f5271124a3.exe
"C:\Users\Admin\AppData\Local\Temp\d329ca03ea62e3371e4d63f5271124a3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\ProgramData\Remcos\remcos.exe
      C:\ProgramData\Remcos\remcos.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 465KB
SHA256 1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16
MD5 d329ca03ea62e3371e4d63f5271124a3
SHA1 14c329ff4882ef1aedb93e21e18b691a93dc2f5d
SHA512 f96a04fafc9c32fb546ebdd4cefb64672a13f4768ec1a1fccc4495183ffc242d8c5f409ee1332f6c1137f537a8a7daa81a359fe552d42f867a9e8a15ef3f055d
SSDEEP 6144:W/Ya3uK4MW5sl80PF2hV/4puXyjSJ5DwFiyycdFXErWksAOZZgjXAccF6N:W/YaejslPd2f/4njSJJwLZ4sfZg/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 465KB
SHA256 1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16
MD5 d329ca03ea62e3371e4d63f5271124a3
SHA1 14c329ff4882ef1aedb93e21e18b691a93dc2f5d
SHA512 f96a04fafc9c32fb546ebdd4cefb64672a13f4768ec1a1fccc4495183ffc242d8c5f409ee1332f6c1137f537a8a7daa81a359fe552d42f867a9e8a15ef3f055d
SSDEEP 6144:W/Ya3uK4MW5sl80PF2hV/4puXyjSJ5DwFiyycdFXErWksAOZZgjXAccF6N:W/YaejslPd2f/4njSJJwLZ4sfZg/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 386B
SHA256 6efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2
MD5 1ec6289c6fd4c2ded6b2836ed28cbeb5
SHA1 c4e08195e6c640eb8860acc03fda1d649b4fe070
SHA512 20bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path \ProgramData\Remcos\remcos.exe
Size 465KB
SHA256 1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16
MD5 d329ca03ea62e3371e4d63f5271124a3
SHA1 14c329ff4882ef1aedb93e21e18b691a93dc2f5d
SHA512 f96a04fafc9c32fb546ebdd4cefb64672a13f4768ec1a1fccc4495183ffc242d8c5f409ee1332f6c1137f537a8a7daa81a359fe552d42f867a9e8a15ef3f055d
SSDEEP 6144:W/Ya3uK4MW5sl80PF2hV/4puXyjSJ5DwFiyycdFXErWksAOZZgjXAccF6N:W/YaejslPd2f/4njSJJwLZ4sfZg/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path \ProgramData\Remcos\remcos.exe
Size 465KB
SHA256 1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16
MD5 d329ca03ea62e3371e4d63f5271124a3
SHA1 14c329ff4882ef1aedb93e21e18b691a93dc2f5d
SHA512 f96a04fafc9c32fb546ebdd4cefb64672a13f4768ec1a1fccc4495183ffc242d8c5f409ee1332f6c1137f537a8a7daa81a359fe552d42f867a9e8a15ef3f055d
SSDEEP 6144:W/Ya3uK4MW5sl80PF2hV/4puXyjSJ5DwFiyycdFXErWksAOZZgjXAccF6N:W/YaejslPd2f/4njSJJwLZ4sfZg/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1428-54-0x00000000754B1000-0x00000000754B3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads