remcos | 2148232876d892bcde50312b51c435f383c84589cc91694fcbc56f33521dd327

General

Target

DHL 2723382830領収書,pdf.exe
Size

654KB
MD5

cb4a7469e6eb99572ba41e5aff6c63c5
SHA1

b760cdb563386f0afbafea1f793d7ba16cef4167
SHA256

55de0a43df1a914bef31d31c8fcdc495a25ebbd90d9ef44a329030da306d9313
SHA512

aa9e6135cdcda394aaa760b7836c27c059fa4afcac8e5b0473c34ead56b39753add220bf8a1cf989bd770032c2adab5975da5b854a2073f3eae011f94f231634

Score

10^/10

rat remcos

Family

remcos

C2

favournwa.ddns.net:7171

Suspicious behavior: EnumeratesProcesses 984 IoCs

Processes:

DHL 2723382830領収書,pdf.exedfghjhjgf.exedfghjhjgf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dfghjhjgf.exe

pid process

1908 dfghjhjgf.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

dfghjhjgf.exe

description pid process target process

PID 1888 set thread context of 1908 1888 dfghjhjgf.exe dfghjhjgf.exe
NTFS ADS 1 IoCs

Processes:

DHL 2723382830領収書,pdf.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\grace\dfghjhjgf.exe:ZoneIdentifier DHL 2723382830領収書,pdf.exe
Drops startup file 1 IoCs

Processes:

dfghjhjgf.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\grace.vbs dfghjhjgf.exe
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Loads dropped DLL 2 IoCs

Processes:

DHL 2723382830領収書,pdf.exe

pid process

1864 DHL 2723382830領収書,pdf.exe
1864 DHL 2723382830領収書,pdf.exe

pid	process
1908	dfghjhjgf.exe

description	pid	process	target process
PID 1888 set thread context of 1908	1888	dfghjhjgf.exe	dfghjhjgf.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\grace\dfghjhjgf.exe:ZoneIdentifier	DHL 2723382830領収書,pdf.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\grace.vbs	dfghjhjgf.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

DHL 2723382830領収書,pdf.exedfghjhjgf.exe

description	pid	process	target process
PID 1864 wrote to memory of 1888	1864	DHL 2723382830領収書,pdf.exe	dfghjhjgf.exe
PID 1864 wrote to memory of 1888	1864	DHL 2723382830領収書,pdf.exe	dfghjhjgf.exe
PID 1864 wrote to memory of 1888	1864	DHL 2723382830領収書,pdf.exe	dfghjhjgf.exe
PID 1864 wrote to memory of 1888	1864	DHL 2723382830領収書,pdf.exe	dfghjhjgf.exe
PID 1888 wrote to memory of 1908	1888	dfghjhjgf.exe	dfghjhjgf.exe
PID 1888 wrote to memory of 1908	1888	dfghjhjgf.exe	dfghjhjgf.exe
PID 1888 wrote to memory of 1908	1888	dfghjhjgf.exe	dfghjhjgf.exe
PID 1888 wrote to memory of 1908	1888	dfghjhjgf.exe	dfghjhjgf.exe
PID 1888 wrote to memory of 1924	1888	dfghjhjgf.exe	dfghjhjgf.exe
PID 1888 wrote to memory of 1924	1888	dfghjhjgf.exe	dfghjhjgf.exe
PID 1888 wrote to memory of 1924	1888	dfghjhjgf.exe	dfghjhjgf.exe
PID 1888 wrote to memory of 1924	1888	dfghjhjgf.exe	dfghjhjgf.exe

Executes dropped EXE 3 IoCs

Processes:

dfghjhjgf.exedfghjhjgf.exedfghjhjgf.exe

pid process

1888 dfghjhjgf.exe
1908 dfghjhjgf.exe
1924 dfghjhjgf.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

dfghjhjgf.exe

pid process

1888 dfghjhjgf.exe

pid	process
1888	dfghjhjgf.exe

C:\Users\Admin\AppData\Roaming\grace\dfghjhjgf.exe

Download Submit
C:\Users\Admin\AppData\Roaming\grace\dfghjhjgf.exe

Download Submit
C:\Users\Admin\AppData\Roaming\grace\dfghjhjgf.exe

Download Submit
C:\Users\Admin\AppData\Roaming\grace\dfghjhjgf.exe

Download Submit
\Users\Admin\AppData\Roaming\grace\dfghjhjgf.exe

Download Submit
\Users\Admin\AppData\Roaming\grace\dfghjhjgf.exe

Download Submit
memory/1908-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1908-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download