remcos | 738ea925d9f26dc03c18efd41de5e310285a36eef0147e7767a25dcf3fb1b24d

General

Target
scanned order 1.scr
Size 660KB
Sample200811-2gr2zva2ms
SHA256 738ea925d9f26dc03c18efd41de5e310285a36eef0147e7767a25dcf3fb1b24d
MD5 6c4bb3b95606b439e5e2fb3414c63b70
SHA1 8b4e9c604c5597c660133da71e23cc1cd81bbe44
SHA512 8b91dc4328c62d56cd2ad023c483733c5375c41fdd68512ae18372e5862e0f3bfa4772036c4ccf70cf04969101ecd51f0c8590ff5149d2146479b3e257a4afdd
MD5 SHA1 SHA512

Score

10^/10

rat remcos

Malware Config

Extracted

Family

remcos

C2

172.111.200.225:8069

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
1420	wimdows.exe
1556	wimdows.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wimdows.vbs	notepad.exe

Loads dropped DLL 2 IoCs

pid	Process
1308	notepad.exe
1308	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 1556	1420	wimdows.exe	26

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\windows updat\wimdows.exe:ZoneIdentifier	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1324	scanned order 1.scr
1420	wimdows.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1420	wimdows.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1556	wimdows.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1308	1324	scanned order 1.scr	24
PID 1324 wrote to memory of 1308	1324	scanned order 1.scr	24
PID 1324 wrote to memory of 1308	1324	scanned order 1.scr	24
PID 1324 wrote to memory of 1308	1324	scanned order 1.scr	24
PID 1324 wrote to memory of 1308	1324	scanned order 1.scr	24
PID 1324 wrote to memory of 1308	1324	scanned order 1.scr	24
PID 1308 wrote to memory of 1420	1308	notepad.exe	25
PID 1308 wrote to memory of 1420	1308	notepad.exe	25
PID 1308 wrote to memory of 1420	1308	notepad.exe	25
PID 1308 wrote to memory of 1420	1308	notepad.exe	25
PID 1420 wrote to memory of 1556	1420	wimdows.exe	26
PID 1420 wrote to memory of 1556	1420	wimdows.exe	26
PID 1420 wrote to memory of 1556	1420	wimdows.exe	26
PID 1420 wrote to memory of 1556	1420	wimdows.exe	26

C:\Users\Admin\AppData\Local\Temp\scanned order 1.scr
"C:\Users\Admin\AppData\Local\Temp\scanned order 1.scr" /S
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Roaming\windows updat\wimdows.exe
    "C:\Users\Admin\AppData\Roaming\windows updat\wimdows.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Users\Admin\AppData\Roaming\windows updat\wimdows.exe
      "C:\Users\Admin\AppData\Roaming\windows updat\wimdows.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-1-0x00000000000D0000-0x00000000000D1000-memory.dmp

Download

memory/1556-7-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1556-10-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads