remcos | 5245ed24d76b45f0d9de8c7ce2a7665ded270b8ba7d6b29191e8592630c19b97

General

Target

090887000008000000.exe
Size

573KB
MD5

e9cf73a3acf2068657359b902c67deef
SHA1

1607d9d4b7f869eb25a3b1e7fcf9359d72718e22
SHA256

5245ed24d76b45f0d9de8c7ce2a7665ded270b8ba7d6b29191e8592630c19b97
SHA512

e49151a25b9876dad31cfd7663934377c6bb989b066ec239bdfd6eda3486e8b9da5bb1f3f4a8315d969d577af31532bb072339e4cec7bb60b3dca38b08e50467

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

45.137.22.52:8780

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

090887000008000000.exe

description pid process target process

PID 1124 set thread context of 224 1124 090887000008000000.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Powershell.exe

pid process

1924 Powershell.exe
1924 Powershell.exe
1924 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 1924 Powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

InstallUtil.exe

pid process

224 InstallUtil.exe

description	pid	process	target process
PID 1124 set thread context of 224	1124	090887000008000000.exe	InstallUtil.exe

pid	process
1924	Powershell.exe
1924	Powershell.exe
1924	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	1924	Powershell.exe

pid	process
224	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

090887000008000000.exe

description	pid	process	target process
PID 1124 wrote to memory of 1924	1124	090887000008000000.exe	Powershell.exe
PID 1124 wrote to memory of 1924	1124	090887000008000000.exe	Powershell.exe
PID 1124 wrote to memory of 1924	1124	090887000008000000.exe	Powershell.exe
PID 1124 wrote to memory of 224	1124	090887000008000000.exe	InstallUtil.exe
PID 1124 wrote to memory of 224	1124	090887000008000000.exe	InstallUtil.exe
PID 1124 wrote to memory of 224	1124	090887000008000000.exe	InstallUtil.exe
PID 1124 wrote to memory of 224	1124	090887000008000000.exe	InstallUtil.exe
PID 1124 wrote to memory of 224	1124	090887000008000000.exe	InstallUtil.exe
PID 1124 wrote to memory of 224	1124	090887000008000000.exe	InstallUtil.exe
PID 1124 wrote to memory of 224	1124	090887000008000000.exe	InstallUtil.exe
PID 1124 wrote to memory of 224	1124	090887000008000000.exe	InstallUtil.exe
PID 1124 wrote to memory of 224	1124	090887000008000000.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\090887000008000000.exe
"C:\Users\Admin\AppData\Local\Temp\090887000008000000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\090887000008000000.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-18-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/224-20-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/224-19-0x000000000040FD88-mapping.dmp

Download
memory/1124-8-0x0000000005A20000-0x0000000005A21000-memory.dmp

Filesize
4KB

Download
memory/1124-17-0x0000000005450000-0x000000000545F000-memory.dmp

Filesize
60KB

Download
memory/1124-2-0x0000000073CB0000-0x000000007439E000-memory.dmp

Filesize
6.9MB

Download
memory/1124-3-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1124-5-0x0000000005000000-0x0000000005045000-memory.dmp

Filesize
276KB

Download
memory/1124-7-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/1124-6-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/1924-11-0x00000000043A0000-0x00000000043A1000-memory.dmp

Filesize
4KB

Download
memory/1924-14-0x0000000006F80000-0x0000000006F81000-memory.dmp

Filesize
4KB

Download
memory/1924-15-0x0000000007740000-0x0000000007741000-memory.dmp

Filesize
4KB

Download
memory/1924-13-0x0000000006DE0000-0x0000000006DE1000-memory.dmp

Filesize
4KB

Download
memory/1924-12-0x0000000007030000-0x0000000007031000-memory.dmp

Filesize
4KB

Download
memory/1924-10-0x0000000073CB0000-0x000000007439E000-memory.dmp

Filesize
6.9MB

Download
memory/1924-9-0x0000000000000000-mapping.dmp

Download
memory/1924-21-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/1924-22-0x0000000007F10000-0x0000000007F11000-memory.dmp

Filesize
4KB

Download
memory/1924-23-0x0000000007E90000-0x0000000007E91000-memory.dmp

Filesize
4KB

Download
memory/1924-24-0x0000000008EA0000-0x0000000008EA1000-memory.dmp

Filesize
4KB

Download
memory/1924-25-0x0000000008B70000-0x0000000008B71000-memory.dmp

Filesize
4KB

Download
memory/1924-26-0x0000000008E00000-0x0000000008E01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads