remcos | cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

General

Target

cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe
Size

1011KB
MD5

19c46de9b1bf0e8c058b66f1a0208ba8
SHA1

3e744b7cae11e14899d85984b92e4f2567ea80d2
SHA256

cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4
SHA512

ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Score

10^/10

remcos 10 rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

10

C2

abujafirms.com:2244

yokiri.com:2244

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-I2Z97W
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 3 IoCs

Processes:

QAZ223.exeQAZ223.exeQAZ223.exe

pid process

3716 QAZ223.exe
3956 QAZ223.exe
1988 QAZ223.exe
Drops startup file 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CV54JB.vbs notepad.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

QAZ223.exe

description pid process target process

PID 3716 set thread context of 3956 3716 QAZ223.exe QAZ223.exe
NTFS ADS 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe:ZoneIdentifier notepad.exe

pid	process
3716	QAZ223.exe
3956	QAZ223.exe
1988	QAZ223.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CV54JB.vbs	notepad.exe

description	pid	process	target process
PID 3716 set thread context of 3956	3716	QAZ223.exe	QAZ223.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe:ZoneIdentifier	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exeQAZ223.exeQAZ223.exe

pid	process
3936	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe
3936	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe
3716	QAZ223.exe
3716	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe
1988	QAZ223.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

QAZ223.exe

pid process

3716 QAZ223.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

QAZ223.exe

pid process

3956 QAZ223.exe

pid	process
3716	QAZ223.exe

pid	process
3956	QAZ223.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exenotepad.exeQAZ223.exe

description	pid	process	target process
PID 3936 wrote to memory of 3928	3936	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 3936 wrote to memory of 3928	3936	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 3936 wrote to memory of 3928	3936	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 3936 wrote to memory of 3928	3936	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 3936 wrote to memory of 3928	3936	cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe	notepad.exe
PID 3928 wrote to memory of 3716	3928	notepad.exe	QAZ223.exe
PID 3928 wrote to memory of 3716	3928	notepad.exe	QAZ223.exe
PID 3928 wrote to memory of 3716	3928	notepad.exe	QAZ223.exe
PID 3716 wrote to memory of 3956	3716	QAZ223.exe	QAZ223.exe
PID 3716 wrote to memory of 3956	3716	QAZ223.exe	QAZ223.exe
PID 3716 wrote to memory of 3956	3716	QAZ223.exe	QAZ223.exe
PID 3716 wrote to memory of 1988	3716	QAZ223.exe	QAZ223.exe
PID 3716 wrote to memory of 1988	3716	QAZ223.exe	QAZ223.exe
PID 3716 wrote to memory of 1988	3716	QAZ223.exe	QAZ223.exe

C:\Users\Admin\AppData\Local\Temp\cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe
"C:\Users\Admin\AppData\Local\Temp\cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
2⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3928

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
"C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3716

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
"C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3956

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
"C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe" 2 3956 259289546
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
19c46de9b1bf0e8c058b66f1a0208ba8

SHA1
3e744b7cae11e14899d85984b92e4f2567ea80d2

SHA256
cac423609eba872cb328488b7aaa34e0d78de5ed46a63ba249335db79913a9f4

SHA512
ceb1ae59af4b28bdd0ef9c45d2599bb8714a90c7c940099a33501f9864c3a76434d03714d4af95a2fd3b15534dc224c434e669833a281eb210ce8036e56b72ea

Download Submit
memory/1988-127-0x0000000000000000-mapping.dmp

Download
memory/1988-132-0x00000000005E0000-0x000000000072A000-memory.dmp

Filesize
1.3MB

Download
memory/1988-131-0x0000000000510000-0x00000000005BE000-memory.dmp

Filesize
696KB

Download
memory/1988-130-0x0000000000510000-0x00000000005BE000-memory.dmp

Filesize
696KB

Download
memory/3716-119-0x0000000000000000-mapping.dmp

Download
memory/3716-124-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/3716-123-0x0000000000510000-0x00000000005BE000-memory.dmp

Filesize
696KB

Download
memory/3928-122-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3928-118-0x0000000000000000-mapping.dmp

Download
memory/3936-116-0x00000000023B0000-0x00000000023C0000-memory.dmp

Filesize
64KB

Download
memory/3936-115-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3936-117-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3956-125-0x0000000000413A84-mapping.dmp

Download
memory/3956-129-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing