9d5992981fd5538fbea3b82c4c5bc14ddd761ed29cbd1f797200f1e2ca307bb0

General

Target

remcos_a.exe
Size

469KB
MD5

c2761b75ca1f79d7fc5230f0ed1c403b
SHA1

8c152a273117df047d021b42e65efb907b46104c
SHA256

9d5992981fd5538fbea3b82c4c5bc14ddd761ed29cbd1f797200f1e2ca307bb0
SHA512

a3b4a6bab2194f6b8142e0826d3d753951c10f3cca2cefff384a925a2d3c7106c8b8b4a8f5935d72c6e90e76f9f064bd9137132fc4335af271a151d665d336ef
SSDEEP

12288:omnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSdn9:YiLJbpI7I2WhQqZ7d9

Score

9^/10

collection spyware stealer

Malware Config

Signatures

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1868-21-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral1/memory/1868-15-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral1/memory/1868-14-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/3684-13-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/3684-11-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/3684-25-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

resource	yara_rule
behavioral1/memory/1868-21-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral1/memory/1028-16-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1868-15-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral1/memory/1868-14-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral1/memory/3684-13-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/3684-11-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/1028-10-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/3684-25-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	remcos_a.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4964 set thread context of 3684	4964	remcos_a.exe	85
PID 4964 set thread context of 1868	4964	remcos_a.exe	86
PID 4964 set thread context of 1028	4964	remcos_a.exe	87

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1028	remcos_a.exe
1028	remcos_a.exe
3684	remcos_a.exe
3684	remcos_a.exe
3684	remcos_a.exe
3684	remcos_a.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4964	remcos_a.exe
4964	remcos_a.exe
4964	remcos_a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	remcos_a.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4964	remcos_a.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4964	remcos_a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3684	4964	remcos_a.exe	85
PID 4964 wrote to memory of 3684	4964	remcos_a.exe	85
PID 4964 wrote to memory of 3684	4964	remcos_a.exe	85
PID 4964 wrote to memory of 1868	4964	remcos_a.exe	86
PID 4964 wrote to memory of 1868	4964	remcos_a.exe	86
PID 4964 wrote to memory of 1868	4964	remcos_a.exe	86
PID 4964 wrote to memory of 1028	4964	remcos_a.exe	87
PID 4964 wrote to memory of 1028	4964	remcos_a.exe	87
PID 4964 wrote to memory of 1028	4964	remcos_a.exe	87

C:\Users\Admin\AppData\Local\Temp\remcos_a.exe
"C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\remcos_a.exe
  C:\Users\Admin\AppData\Local\Temp\remcos_a.exe /stext "C:\Users\Admin\AppData\Local\Temp\qhivglmmmjjdllbfxjdcusov"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Users\Admin\AppData\Local\Temp\remcos_a.exe
  C:\Users\Admin\AppData\Local\Temp\remcos_a.exe /stext "C:\Users\Admin\AppData\Local\Temp\abvnhdxoarbivrpjhupdxxjmpyz"
  2⤵
  - Accesses Microsoft Outlook accounts
  PID:1868
- C:\Users\Admin\AppData\Local\Temp\remcos_a.exe
  C:\Users\Admin\AppData\Local\Temp\remcos_a.exe /stext "C:\Users\Admin\AppData\Local\Temp\cdagiwiioztvxxlnyfcxikvvynrugp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qhivglmmmjjdllbfxjdcusov

Filesize
4KB

MD5
8651f1ecc401fe73c45d06863467d144

SHA1
0150ba4649afe382ae1705552473bba7beb990f4

SHA256
51827e101e890667e6d9b8aa7b804d56b53cadc110b5b8b834229788c29a65e8

SHA512
c0b371d9080c0e82adae100a9400bb7bd239cfe243c072dde0f9310524b92d16a10db9117403d8af227cef9def552dba7c04da3b3bd46a88836acc071cb9890f

Download Submit
memory/1028-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1028-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1028-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1028-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1868-21-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1868-14-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1868-15-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1868-5-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1868-3-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3684-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3684-11-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3684-1-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3684-6-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3684-25-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing