Analysis
- max time kernel
101s - max time network
111s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
10/07/2025, 05:56
General
- Target Bank Details-Update Form-Pdf.exe
- Size 943KB
- Sample250710-gm684sym12
- SHA256 36f0e0b31d5b901268c65a2d5dd8b48a0e9c9b00a329c10be9a7be625fe5d84d
Malware Config
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank Details-Update Form-Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank Details-Update Form-Pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bank Details-Update Form-Pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WLLJgX.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WLLJgX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEBE6.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\ProgramData\Remcos\remcos.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exeC:\ProgramData\Remcos\remcos.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
remcos.exe
remcos.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_o3ygvfcr.cfa.ps1
tmpEBE6.tmp
memory/1440-99-0x0000000004A60000-0x0000000004BBA000-memory.dmp
memory/1440-98-0x00000000023C0000-0x00000000023DA000-memory.dmp
memory/1440-97-0x00000000000A0000-0x00000000000E0000-memory.dmp
memory/3580-4-0x0000000004CA0000-0x0000000004CAA000-memory.dmp
memory/3580-8-0x0000000006400000-0x00000000064C6000-memory.dmp
memory/3580-7-0x0000000004F00000-0x0000000004F10000-memory.dmp
memory/3580-6-0x0000000005280000-0x0000000005294000-memory.dmp
memory/3580-5-0x0000000004E20000-0x0000000004EBC000-memory.dmp
memory/3580-3-0x0000000004F00000-0x0000000004F10000-memory.dmp
memory/3580-2-0x0000000004D80000-0x0000000004E12000-memory.dmp
memory/3580-1-0x0000000005290000-0x0000000005836000-memory.dmp
memory/3580-0-0x0000000000230000-0x0000000000322000-memory.dmp
memory/3908-44-0x0000000005C80000-0x0000000005C9E000-memory.dmp
memory/3908-103-0x0000000006C40000-0x0000000006C74000-memory.dmp
memory/3908-13-0x0000000004940000-0x0000000004950000-memory.dmp
memory/3908-132-0x0000000007310000-0x0000000007318000-memory.dmp
memory/3908-127-0x0000000007260000-0x00000000072F6000-memory.dmp
memory/3908-126-0x0000000007050000-0x000000000705A000-memory.dmp
memory/3908-45-0x0000000005CD0000-0x0000000005D1C000-memory.dmp
memory/3908-19-0x0000000004EE0000-0x0000000004F02000-memory.dmp
memory/3908-124-0x0000000007620000-0x0000000007C9A000-memory.dmp
memory/3908-17-0x0000000004F80000-0x00000000055AA000-memory.dmp
memory/3908-15-0x0000000004940000-0x0000000004950000-memory.dmp
memory/3908-14-0x00000000047D0000-0x0000000004806000-memory.dmp
memory/3908-104-0x0000000071360000-0x00000000713AC000-memory.dmp
memory/3908-125-0x0000000006FD0000-0x0000000006FEA000-memory.dmp
memory/3908-113-0x0000000006260000-0x000000000627E000-memory.dmp
memory/3908-114-0x0000000006E80000-0x0000000006F24000-memory.dmp
memory/4236-115-0x0000000071360000-0x00000000713AC000-memory.dmp
memory/4236-20-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/4236-16-0x00000000026C0000-0x00000000026D0000-memory.dmp
memory/4236-21-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/4236-128-0x00000000073F0000-0x0000000007401000-memory.dmp
memory/4236-129-0x0000000007420000-0x000000000742E000-memory.dmp
memory/4236-130-0x0000000007430000-0x0000000007445000-memory.dmp
memory/4236-131-0x0000000007540000-0x000000000755A000-memory.dmp
memory/4236-38-0x00000000059C0000-0x0000000005D17000-memory.dmp
memory/4820-39-0x0000000000400000-0x0000000000483000-memory.dmp
memory/4820-40-0x0000000000400000-0x0000000000483000-memory.dmp