remcos | 5245ed24d76b45f0d9de8c7ce2a7665ded270b8ba7d6b29191e8592630c19b97

General

Target

090887000008000000.exe
Size

573KB
MD5

e9cf73a3acf2068657359b902c67deef
SHA1

1607d9d4b7f869eb25a3b1e7fcf9359d72718e22
SHA256

5245ed24d76b45f0d9de8c7ce2a7665ded270b8ba7d6b29191e8592630c19b97
SHA512

e49151a25b9876dad31cfd7663934377c6bb989b066ec239bdfd6eda3486e8b9da5bb1f3f4a8315d969d577af31532bb072339e4cec7bb60b3dca38b08e50467

Score

10^/10

remcos rat

Family

remcos

C2

45.137.22.52:8780

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

090887000008000000.exe

description pid process target process

PID 1036 set thread context of 1984 1036 090887000008000000.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Powershell.exe

pid process

2036 Powershell.exe
2036 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 2036 Powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

InstallUtil.exe

pid process

1984 InstallUtil.exe

description	pid	process	target process
PID 1036 set thread context of 1984	1036	090887000008000000.exe	InstallUtil.exe

pid	process
2036	Powershell.exe
2036	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	2036	Powershell.exe

pid	process
1984	InstallUtil.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

090887000008000000.exe

description	pid	process	target process
PID 1036 wrote to memory of 2036	1036	090887000008000000.exe	Powershell.exe
PID 1036 wrote to memory of 2036	1036	090887000008000000.exe	Powershell.exe
PID 1036 wrote to memory of 2036	1036	090887000008000000.exe	Powershell.exe
PID 1036 wrote to memory of 2036	1036	090887000008000000.exe	Powershell.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe
PID 1036 wrote to memory of 1984	1036	090887000008000000.exe	InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1984

memory/1036-10-0x00000000004D0000-0x00000000004DF000-memory.dmp

Filesize
60KB

Download
memory/1036-3-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/1036-5-0x0000000000220000-0x0000000000265000-memory.dmp

Filesize
276KB

Download
memory/1036-2-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/1984-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1984-12-0x000000000040FD88-mapping.dmp

Download
memory/1984-11-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2036-7-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2036-9-0x0000000004760000-0x0000000004761000-memory.dmp

Filesize
4KB

Download
memory/2036-8-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2036-6-0x0000000000000000-mapping.dmp

Download
memory/2036-14-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/2036-15-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/2036-18-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/2036-23-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/2036-24-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/2036-31-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download