remcos | d550de93da7329aec21aeb9cb81edf335dc42507d53d0367445c15180737089f

General

Target
tmpbz1q1p0l.exe
Size 515KB
Sample260524-2t82hagy6k
SHA256 d550de93da7329aec21aeb9cb81edf335dc42507d53d0367445c15180737089f
MD5 88c33ee177ba69de067e7eea4156fef3
SHA1 bad02adb549bc4aabb8a998c73e1f8462e18871f
SHA512 868020462fff001826070a1b938e42c0f444e913bc6c2cdc7c4b06fcbcdd330fb2857a26f3a455b205aec2b9e019efeb7f2bef2a2779afab051e711a6cb56f6c
SSDEEP 6144:bXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBcew:rENlHV9FGeDWv3jADnyYiCNrsPZ0S
TLSH
T163B4BF01B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery remcos rat suricata

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 8 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 10 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
2	3920	tmpbz1q1p0l.exe
3	3920	tmpbz1q1p0l.exe
3	3920	tmpbz1q1p0l.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral3/memory/1648-6-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	userinit.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key queried	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 4672	3920	tmpbz1q1p0l.exe	81
PID 3920 set thread context of 2748	3920	tmpbz1q1p0l.exe	82
PID 3920 set thread context of 1648	3920	tmpbz1q1p0l.exe	83

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpbz1q1p0l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4672	userinit.exe
4672	userinit.exe
1648	userinit.exe
1648	userinit.exe
4672	userinit.exe
4672	userinit.exe
4672	userinit.exe
4672	userinit.exe
4672	userinit.exe
4672	userinit.exe
4672	userinit.exe
4672	userinit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	userinit.exe
Token: SeImpersonatePrivilege	4672	userinit.exe
Token: SeImpersonatePrivilege	4672	userinit.exe
Token: SeImpersonatePrivilege	4672	userinit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3920	tmpbz1q1p0l.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4672	3920	tmpbz1q1p0l.exe	81
PID 3920 wrote to memory of 2748	3920	tmpbz1q1p0l.exe	82
PID 3920 wrote to memory of 1648	3920	tmpbz1q1p0l.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

C:\Users\Admin\AppData\Local\Temp\tmpbz1q1p0l.exe
"C:\Users\Admin\AppData\Local\Temp\tmpbz1q1p0l.exe"
1⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\ojhwz"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\ylupzhpm"
  2⤵
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - outlook_office_path
  PID:2748
- C:\Windows\SysWOW64\userinit.exe
  /stext "C:\Users\Admin\AppData\Local\Temp\afzzaaantvu"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

2

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ojhwz

Path C:\Users\Admin\AppData\Local\Temp\ojhwz
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1648-2-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1648-6-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2748-1-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2748-8-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3920-13-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3920-17-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3920-16-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4672-0-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4672-11-0x0000000000400000-0x000000000047E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads