remcos

General

Target
Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe
Size 1.8MB
Sample201119-xpdsd3yd9a
SHA256 6f493867adbd74622c28e2c1e670b4c1f64566ea830dbf7bd0c5905b858a33c8
MD5 da9cf305f26cf0748736fd063f56e801
SHA1 8058d432c1b01f056786b62fb3e518f0c14192f5
SHA512 4f79bbc53f7f1a6f08d7a4793bf58c447e8f62a3c6fa59185e53df007f43afac110d53ce15bc4585f6c33cd67a9c045eb7ecf2e301ae3ebe73bb158d5d17c936
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:7580

Targets

- Target
  Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe
- Size 1.8MB
- SHA256 6f493867adbd74622c28e2c1e670b4c1f64566ea830dbf7bd0c5905b858a33c8
- MD5 da9cf305f26cf0748736fd063f56e801
- SHA1 8058d432c1b01f056786b62fb3e518f0c14192f5
- SHA512 4f79bbc53f7f1a6f08d7a4793bf58c447e8f62a3c6fa59185e53df007f43afac110d53ce15bc4585f6c33cd67a9c045eb7ecf2e301ae3ebe73bb158d5d17c936
- MD5 SHA1 SHA512
Score

10^/10

remcos persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- ServiceHost packer
  Detects ServiceHost packer used for .NET malware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

ServiceHost packer

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2