remcos | 4a3ee480e184ee589aae2817674cf6ecdf9ed829db8388d7e85bc8a95bc69bd2

General

Target

Shipping_Document.exe
Size

736KB
MD5

8809c7cab903669b1da338f39327a7c3
SHA1

7b19e931f2ab478e1189431a216f1cc2c9b43d8d
SHA256

86fffe8373d8bbcc79e4105465a3775bb9a2b4d35fb47961ab6173558bfeda14
SHA512

33bfbfd4729fb6ed94e27f323c668c92e7c1394e4628e236e16fff0bee0df0644ca29e666679e7a8b92cf077267aeff43bbf5c35e57d68ee80d11956cb246cac

Score

10^/10

remcos young rat

Family

remcos

Botnet

Young

C2

june248.ddns.net:3759

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2124 508 WerFault.exe Shipping_Document.exe

pid	pid_target	process	target process
2124	508	WerFault.exe	Shipping_Document.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2124 WerFault.exe
Token: SeBackupPrivilege 2124 WerFault.exe
Token: SeDebugPrivilege 2124 WerFault.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Shipping_Document.exe

description	pid	process	target process
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe
PID 508 wrote to memory of 1032	508	Shipping_Document.exe	logagent.exe

C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 1264
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  PID:1032

memory/508-114-0x00000000005F0000-0x000000000073A000-memory.dmp

Filesize
1.3MB

Download
memory/1032-115-0x0000000000000000-mapping.dmp

Download
memory/1032-117-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1032-116-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1032-119-0x0000000010590000-0x000000001060D000-memory.dmp

Filesize
500KB

Download
memory/1032-118-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1032-120-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download