remcos | d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6

General

Target

User Help Services.exe
Size

3.6MB
MD5

8333ca39ae364a0c977dc6d304495a05
SHA1

fb0fb6f73019f645aaaa6b7ffd40c2d9df39e5de
SHA256

d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6
SHA512

e010f5130262a96bcf1f779ca3a708070adc99802eb9d278e6300eaa7b950019595019e1bd974401de4e75d130a990501be06f31066471e7e2e0af2f4f63cc2e

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

95.154.196.12:5851

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Drops file in Windows directory 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Windows\Tasks\vmtools.job notepad.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

User Help Services.exenslookup.exe

pid process

1640 User Help Services.exe
1816 nslookup.exe
1816 nslookup.exe
1816 nslookup.exe
1816 nslookup.exe
1816 nslookup.exe
1816 nslookup.exe
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

nslookup.exe

pid process

1816 nslookup.exe
1816 nslookup.exe
1816 nslookup.exe
1816 nslookup.exe
1816 nslookup.exe
1816 nslookup.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

User Help Services.exenotepad.exe

pid process

1640 User Help Services.exe
1104 notepad.exe

description	ioc	process
File created	C:\Windows\Tasks\vmtools.job	notepad.exe

pid	process
1640	User Help Services.exe
1816	nslookup.exe
1816	nslookup.exe
1816	nslookup.exe
1816	nslookup.exe
1816	nslookup.exe
1816	nslookup.exe

pid	process
1816	nslookup.exe
1816	nslookup.exe
1816	nslookup.exe
1816	nslookup.exe
1816	nslookup.exe
1816	nslookup.exe

pid	process
1640	User Help Services.exe
1104	notepad.exe

Suspicious use of WriteProcessMemory 149 IoCs

Processes:

User Help Services.exenslookup.exe

description	pid	process	target process
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1640 wrote to memory of 1816	1640	User Help Services.exe	nslookup.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 820	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 692	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 304	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 304	1816	nslookup.exe	cmd.exe
PID 1816 wrote to memory of 304	1816	nslookup.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\User Help Services.exe
"C:\Users\Admin\AppData\Local\Temp\User Help Services.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:304

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:1348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:388

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-3-0x0000000000000000-mapping.dmp

Download
memory/1104-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1816-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads