remcos | dcfaf32061b7ac3546b3d618dfea1372195cc4d57ff21de2cf6c918797cfa788

General

Target

kart gecmisi.exe
Size

578KB
MD5

7495739b74f9944c06d6b005421af606
SHA1

79a1d3dc1a2c97c06f8749da5a9f4bc08ecc131f
SHA256

dcfaf32061b7ac3546b3d618dfea1372195cc4d57ff21de2cf6c918797cfa788
SHA512

3f6de9c9fbf290e9c28e724cfecbd2b00f33d63bd0c21b4da4cbe4d40a8ce62c39b57374da38df0bbd2c2783659c9464bbdd062c786ec96452ccd4d1792534d4

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

C2

45.137.22.52:8780

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

kart gecmisi.exe

description pid process target process

PID 4688 set thread context of 3848 4688 kart gecmisi.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Powershell.exe

pid process

2248 Powershell.exe
2248 Powershell.exe
2248 Powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

InstallUtil.exe

pid process

3848 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 2248 Powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

InstallUtil.exe

pid process

3848 InstallUtil.exe

description	pid	process	target process
PID 4688 set thread context of 3848	4688	kart gecmisi.exe	InstallUtil.exe

pid	process
2248	Powershell.exe
2248	Powershell.exe
2248	Powershell.exe

pid	process
3848	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2248	Powershell.exe

pid	process
3848	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

kart gecmisi.exe

description	pid	process	target process
PID 4688 wrote to memory of 2248	4688	kart gecmisi.exe	Powershell.exe
PID 4688 wrote to memory of 2248	4688	kart gecmisi.exe	Powershell.exe
PID 4688 wrote to memory of 2248	4688	kart gecmisi.exe	Powershell.exe
PID 4688 wrote to memory of 3848	4688	kart gecmisi.exe	InstallUtil.exe
PID 4688 wrote to memory of 3848	4688	kart gecmisi.exe	InstallUtil.exe
PID 4688 wrote to memory of 3848	4688	kart gecmisi.exe	InstallUtil.exe
PID 4688 wrote to memory of 3848	4688	kart gecmisi.exe	InstallUtil.exe
PID 4688 wrote to memory of 3848	4688	kart gecmisi.exe	InstallUtil.exe
PID 4688 wrote to memory of 3848	4688	kart gecmisi.exe	InstallUtil.exe
PID 4688 wrote to memory of 3848	4688	kart gecmisi.exe	InstallUtil.exe
PID 4688 wrote to memory of 3848	4688	kart gecmisi.exe	InstallUtil.exe
PID 4688 wrote to memory of 3848	4688	kart gecmisi.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\kart gecmisi.exe
"C:\Users\Admin\AppData\Local\Temp\kart gecmisi.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4688

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\kart gecmisi.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-11-0x0000000000000000-mapping.dmp

Download
memory/2248-23-0x0000000007AD0000-0x0000000007AD1000-memory.dmp

Filesize
4KB

Download
memory/2248-27-0x0000000008BD0000-0x0000000008BD1000-memory.dmp

Filesize
4KB

Download
memory/2248-26-0x0000000008CB0000-0x0000000008CB1000-memory.dmp

Filesize
4KB

Download
memory/2248-19-0x0000000007510000-0x0000000007511000-memory.dmp

Filesize
4KB

Download
memory/2248-24-0x0000000008150000-0x0000000008151000-memory.dmp

Filesize
4KB

Download
memory/2248-28-0x0000000008C40000-0x0000000008C41000-memory.dmp

Filesize
4KB

Download
memory/2248-21-0x0000000007580000-0x0000000007581000-memory.dmp

Filesize
4KB

Download
memory/2248-25-0x0000000007E90000-0x0000000007E91000-memory.dmp

Filesize
4KB

Download
memory/2248-12-0x0000000073430000-0x0000000073B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2248-13-0x0000000006760000-0x0000000006761000-memory.dmp

Filesize
4KB

Download
memory/2248-14-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Filesize
4KB

Download
memory/2248-18-0x0000000007470000-0x0000000007471000-memory.dmp

Filesize
4KB

Download
memory/3848-17-0x000000000040FD88-mapping.dmp

Download
memory/3848-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3848-20-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4688-9-0x0000000008B60000-0x0000000008B61000-memory.dmp

Filesize
4KB

Download
memory/4688-15-0x0000000008EF0000-0x0000000008EFF000-memory.dmp

Filesize
60KB

Download
memory/4688-10-0x0000000008F90000-0x0000000008F91000-memory.dmp

Filesize
4KB

Download
memory/4688-2-0x0000000073430000-0x0000000073B1E000-memory.dmp

Filesize
6.9MB

Download
memory/4688-8-0x0000000008B10000-0x0000000008B55000-memory.dmp

Filesize
276KB

Download
memory/4688-7-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/4688-6-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/4688-5-0x0000000005A80000-0x0000000005A81000-memory.dmp

Filesize
4KB

Download
memory/4688-3-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads