remcos | dcfaf32061b7ac3546b3d618dfea1372195cc4d57ff21de2cf6c918797cfa788

General

Target

kart gecmisi.exe
Size

578KB
MD5

7495739b74f9944c06d6b005421af606
SHA1

79a1d3dc1a2c97c06f8749da5a9f4bc08ecc131f
SHA256

dcfaf32061b7ac3546b3d618dfea1372195cc4d57ff21de2cf6c918797cfa788
SHA512

3f6de9c9fbf290e9c28e724cfecbd2b00f33d63bd0c21b4da4cbe4d40a8ce62c39b57374da38df0bbd2c2783659c9464bbdd062c786ec96452ccd4d1792534d4

Score

10^/10

remcos rat

Family

remcos

C2

45.137.22.52:8780

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

kart gecmisi.exe

description pid process target process

PID 932 set thread context of 1816 932 kart gecmisi.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Powershell.exe

pid process

1500 Powershell.exe
1500 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 1500 Powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

InstallUtil.exe

pid process

1816 InstallUtil.exe

description	pid	process	target process
PID 932 set thread context of 1816	932	kart gecmisi.exe	InstallUtil.exe

pid	process
1500	Powershell.exe
1500	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	1500	Powershell.exe

pid	process
1816	InstallUtil.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

kart gecmisi.exe

description	pid	process	target process
PID 932 wrote to memory of 1500	932	kart gecmisi.exe	Powershell.exe
PID 932 wrote to memory of 1500	932	kart gecmisi.exe	Powershell.exe
PID 932 wrote to memory of 1500	932	kart gecmisi.exe	Powershell.exe
PID 932 wrote to memory of 1500	932	kart gecmisi.exe	Powershell.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe
PID 932 wrote to memory of 1816	932	kart gecmisi.exe	InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1816

memory/932-10-0x0000000001FC0000-0x0000000001FCF000-memory.dmp

Filesize
60KB

Download
memory/932-3-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/932-5-0x0000000002010000-0x0000000002055000-memory.dmp

Filesize
276KB

Download
memory/932-2-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/1500-15-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1500-8-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1500-9-0x0000000004850000-0x0000000004851000-memory.dmp

Filesize
4KB

Download
memory/1500-7-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/1500-14-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/1500-6-0x0000000000000000-mapping.dmp

Download
memory/1500-18-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Filesize
4KB

Download
memory/1500-23-0x0000000006080000-0x0000000006081000-memory.dmp

Filesize
4KB

Download
memory/1500-24-0x0000000006120000-0x0000000006121000-memory.dmp

Filesize
4KB

Download
memory/1500-31-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/1816-12-0x000000000040FD88-mapping.dmp

Download
memory/1816-11-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1816-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download