remcos | 779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e

General

Target

779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe
Size

662KB
MD5

62a83d982c702f0a42aa618a95959987
SHA1

4e024ad04b914afba1efc8b161860674da40c75a
SHA256

779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e
SHA512

2ca5c2a71d137ae6e5e3eec856e62dd6d99911bc76e68f23eb128bd7fab7e3e1c3a70a04b5559ef62789b70c386b421b06d981b1f55ec9103282992ff91ae398
SSDEEP

12288:ptnlaPwq8HRQoWR87YSdEEYunKDLnWFcyCcPMweEP:PAKHyoWR87YSGWKXccDcPfP

Score

10^/10

remcos discovery rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Loads dropped DLL 1 IoCs

pid	Process
2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2872 set thread context of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2872 wrote to memory of 2224	2872	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	30
PID 2224 wrote to memory of 2852	2224	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	31
PID 2224 wrote to memory of 2852	2224	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	31
PID 2224 wrote to memory of 2852	2224	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	31
PID 2224 wrote to memory of 2852	2224	779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe	31

C:\Users\Admin\AppData\Local\Temp\779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe
"C:\Users\Admin\AppData\Local\Temp\779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe
  "C:\Users\Admin\AppData\Local\Temp\779605a717a75905d70a752b8199f26598079a9cefaa4ee1768cf1083712f47e.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 404
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst58EA.tmp\awjx.dll

Filesize
20KB

MD5
213e480b87636c56a73a61de53f0c3c8

SHA1
0425ea30b6ae2eca54a8e55e1b7950dc0f5c1412

SHA256
f8c73afa54aeed213fe0f60b0f3fd7e95ad292941a1dcd7cb9d94dc3b0571637

SHA512
7b326838f0a8a214a932f58c66a37b0d6c7972e0ec089f7528c34041b8891c4a4b71d99d7630ff5c4bcbca83cd2aa25b4e8da30bdb1755339aa7ee5d079a4d34

Download Submit
memory/2224-9-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2224-11-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2224-12-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2224-13-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2852-14-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2872-7-0x0000000074745000-0x0000000074747000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing