remcos | d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6

General

Target

User Help Services.exe
Size

3.6MB
MD5

8333ca39ae364a0c977dc6d304495a05
SHA1

fb0fb6f73019f645aaaa6b7ffd40c2d9df39e5de
SHA256

d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6
SHA512

e010f5130262a96bcf1f779ca3a708070adc99802eb9d278e6300eaa7b950019595019e1bd974401de4e75d130a990501be06f31066471e7e2e0af2f4f63cc2e

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

95.154.196.12:5851

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 1 IoCs

Processes:

cmd.exe

flow pid process

17 2080 cmd.exe
Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\vmtools.job cmd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

User Help Services.exenslookup.exe

pid process

1924 User Help Services.exe
3856 nslookup.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

nslookup.exe

pid process

3856 nslookup.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

User Help Services.execmd.exe

pid process

1924 User Help Services.exe
2080 cmd.exe

flow	pid	process
17	2080	cmd.exe

description	ioc	process
File created	C:\Windows\Tasks\vmtools.job	cmd.exe

pid	process
1924	User Help Services.exe
3856	nslookup.exe

pid	process
3856	nslookup.exe

pid	process
1924	User Help Services.exe
2080	cmd.exe

Suspicious use of WriteProcessMemory 162 IoCs

Processes:

User Help Services.exe

description	pid	process	target process
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe
PID 1924 wrote to memory of 3856	1924	User Help Services.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\User Help Services.exe
"C:\Users\Admin\AppData\Local\Temp\User Help Services.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-3-0x0000000000000000-mapping.dmp

Download
memory/2080-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3856-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads