1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16

General

Target
d329ca03ea62e3371e4d63f5271124a3.exe
Size 465KB
Sample220720-xa78msffck
SHA256 1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16
MD5 d329ca03ea62e3371e4d63f5271124a3
SHA1 14c329ff4882ef1aedb93e21e18b691a93dc2f5d
SHA512 f96a04fafc9c32fb546ebdd4cefb64672a13f4768ec1a1fccc4495183ffc242d8c5f409ee1332f6c1137f537a8a7daa81a359fe552d42f867a9e8a15ef3f055d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2308	remcos.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	d329ca03ea62e3371e4d63f5271124a3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	d329ca03ea62e3371e4d63f5271124a3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	d329ca03ea62e3371e4d63f5271124a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	d329ca03ea62e3371e4d63f5271124a3.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run\	d329ca03ea62e3371e4d63f5271124a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	d329ca03ea62e3371e4d63f5271124a3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2308	remcos.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 4852	3864	d329ca03ea62e3371e4d63f5271124a3.exe	81
PID 3864 wrote to memory of 4852	3864	d329ca03ea62e3371e4d63f5271124a3.exe	81
PID 3864 wrote to memory of 4852	3864	d329ca03ea62e3371e4d63f5271124a3.exe	81
PID 4852 wrote to memory of 332	4852	WScript.exe	82
PID 4852 wrote to memory of 332	4852	WScript.exe	82
PID 4852 wrote to memory of 332	4852	WScript.exe	82
PID 332 wrote to memory of 2308	332	cmd.exe	84
PID 332 wrote to memory of 2308	332	cmd.exe	84
PID 332 wrote to memory of 2308	332	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\d329ca03ea62e3371e4d63f5271124a3.exe
"C:\Users\Admin\AppData\Local\Temp\d329ca03ea62e3371e4d63f5271124a3.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\ProgramData\Remcos\remcos.exe
      C:\ProgramData\Remcos\remcos.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 465KB
SHA256 1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16
MD5 d329ca03ea62e3371e4d63f5271124a3
SHA1 14c329ff4882ef1aedb93e21e18b691a93dc2f5d
SHA512 f96a04fafc9c32fb546ebdd4cefb64672a13f4768ec1a1fccc4495183ffc242d8c5f409ee1332f6c1137f537a8a7daa81a359fe552d42f867a9e8a15ef3f055d
SSDEEP 6144:W/Ya3uK4MW5sl80PF2hV/4puXyjSJ5DwFiyycdFXErWksAOZZgjXAccF6N:W/YaejslPd2f/4njSJJwLZ4sfZg/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 465KB
SHA256 1c048a93fc173bacc2388da1042140aeb4d4b34c927e524d3b60946efdab1a16
MD5 d329ca03ea62e3371e4d63f5271124a3
SHA1 14c329ff4882ef1aedb93e21e18b691a93dc2f5d
SHA512 f96a04fafc9c32fb546ebdd4cefb64672a13f4768ec1a1fccc4495183ffc242d8c5f409ee1332f6c1137f537a8a7daa81a359fe552d42f867a9e8a15ef3f055d
SSDEEP 6144:W/Ya3uK4MW5sl80PF2hV/4puXyjSJ5DwFiyycdFXErWksAOZZgjXAccF6N:W/YaejslPd2f/4njSJJwLZ4sfZg/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 386B
SHA256 6efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2
MD5 1ec6289c6fd4c2ded6b2836ed28cbeb5
SHA1 c4e08195e6c640eb8860acc03fda1d649b4fe070
SHA512 20bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads