remcos | cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

General

Target

cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe
Size

1011KB
MD5

19c46de9b1bf0e8c058b66f1a0208ba8
SHA1

3e744b7cae11e14899d85984b92e4f2567ea80d2
SHA256

cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4
SHA512

ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Score

10^/10

remcos 10 rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

10

C2

abujafirms.com:2244

yokiri.com:2244

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-I2Z97W
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 3 IoCs

Processes:

QAZ223.exeQAZ223.exeQAZ223.exe

pid process

1324 QAZ223.exe
1524 QAZ223.exe
1908 QAZ223.exe
Drops startup file 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CV54JB.vbs notepad.exe
Loads dropped DLL 2 IoCs

Processes:

notepad.exe

pid process

1440 notepad.exe
1440 notepad.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

QAZ223.exe

description pid process target process

PID 1324 set thread context of 1524 1324 QAZ223.exe QAZ223.exe
NTFS ADS 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe:ZoneIdentifier notepad.exe

pid	process
1324	QAZ223.exe
1524	QAZ223.exe
1908	QAZ223.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CV54JB.vbs	notepad.exe

pid	process
1440	notepad.exe
1440	notepad.exe

description	pid	process	target process
PID 1324 set thread context of 1524	1324	QAZ223.exe	QAZ223.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe:ZoneIdentifier	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exeQAZ223.exeQAZ223.exe

pid	process
1708	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe
1324	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe
1908	QAZ223.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

QAZ223.exe

pid process

1324 QAZ223.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

QAZ223.exe

pid process

1524 QAZ223.exe

pid	process
1324	QAZ223.exe

pid	process
1524	QAZ223.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exenotepad.exeQAZ223.exe

description	pid	process	target process
PID 1708 wrote to memory of 1440	1708	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 1708 wrote to memory of 1440	1708	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 1708 wrote to memory of 1440	1708	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 1708 wrote to memory of 1440	1708	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 1708 wrote to memory of 1440	1708	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 1708 wrote to memory of 1440	1708	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 1440 wrote to memory of 1324	1440	notepad.exe	QAZ223.exe
PID 1440 wrote to memory of 1324	1440	notepad.exe	QAZ223.exe
PID 1440 wrote to memory of 1324	1440	notepad.exe	QAZ223.exe
PID 1440 wrote to memory of 1324	1440	notepad.exe	QAZ223.exe
PID 1324 wrote to memory of 1524	1324	QAZ223.exe	QAZ223.exe
PID 1324 wrote to memory of 1524	1324	QAZ223.exe	QAZ223.exe
PID 1324 wrote to memory of 1524	1324	QAZ223.exe	QAZ223.exe
PID 1324 wrote to memory of 1524	1324	QAZ223.exe	QAZ223.exe
PID 1324 wrote to memory of 1908	1324	QAZ223.exe	QAZ223.exe
PID 1324 wrote to memory of 1908	1324	QAZ223.exe	QAZ223.exe
PID 1324 wrote to memory of 1908	1324	QAZ223.exe	QAZ223.exe
PID 1324 wrote to memory of 1908	1324	QAZ223.exe	QAZ223.exe

C:\Users\Admin\AppData\Local\Temp\cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe
"C:\Users\Admin\AppData\Local\Temp\cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
2⤵
- Drops startup file
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
"C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
"C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
"C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe" 2 1524 259357668
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
memory/1324-71-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1324-72-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1324-67-0x0000000000000000-mapping.dmp

Download
memory/1440-70-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1440-63-0x0000000000000000-mapping.dmp

Download
memory/1524-74-0x0000000000413A84-mapping.dmp

Download
memory/1524-80-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1708-59-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1708-60-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1708-62-0x0000000001D90000-0x0000000001D91000-memory.dmp

Filesize
4KB

Download
memory/1708-61-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/1908-77-0x0000000000000000-mapping.dmp

Download
memory/1908-81-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1908-82-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing