remcos | 0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70

General

Target

0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70.dll
Size

4.5MB
MD5

d73134c0b780595c6c95f8568c1f81a7
SHA1

19bd711b9d66df0353f5d74ae9ef6c30909dba78
SHA256

0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70
SHA512

e2e6659efdd82ab817c61cfb40669736c2db8c73737de571df7470f5477730e03cb32910e31304fba27dba754de80f7dbe8bdef73a280299b3d9fd307dbea176

Score

10^/10

remcos 1 rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

1

C2

193.111.198.220:5861

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Logs
keylog_path
%Temp%
mouse_option
false
mutex
5850Port-UAYNLL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 9 IoCs

Processes:

cmd.exe

flow pid process

6 1536 cmd.exe
7 1536 cmd.exe
8 1536 cmd.exe
9 1536 cmd.exe
10 1536 cmd.exe
11 1536 cmd.exe
12 1536 cmd.exe
13 1536 cmd.exe
14 1536 cmd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exenslookup.exe

pid process

1972 rundll32.exe
328 nslookup.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

nslookup.exe

pid process

328 nslookup.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rundll32.execmd.exe

pid process

1972 rundll32.exe
1536 cmd.exe

flow	pid	process
6	1536	cmd.exe
7	1536	cmd.exe
8	1536	cmd.exe
9	1536	cmd.exe
10	1536	cmd.exe
11	1536	cmd.exe
12	1536	cmd.exe
13	1536	cmd.exe
14	1536	cmd.exe

pid	process
1972	rundll32.exe
328	nslookup.exe

pid	process
328	nslookup.exe

pid	process
1972	rundll32.exe
1536	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exenslookup.exe

description	pid	process	target process
PID 1468 wrote to memory of 1972	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1972	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1972	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1972	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1972	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1972	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 1972	1468	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 1972 wrote to memory of 328	1972	rundll32.exe	nslookup.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe
PID 328 wrote to memory of 1536	328	nslookup.exe	cmd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Blocklisted process makes network request
- Suspicious use of SetWindowsHookEx
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-61-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download
memory/328-63-0x00000000044C7000-0x00000000044D7000-memory.dmp

Filesize
64KB

Download
memory/328-72-0x00000000044C7000-0x00000000044D7000-memory.dmp

Filesize
64KB

Download
memory/328-57-0x0000000000000000-mapping.dmp

Download
memory/328-62-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download
memory/328-60-0x00000000044C0000-0x00000000044F6000-memory.dmp

Filesize
216KB

Download
memory/1536-66-0x0000000077BA0000-0x0000000077D49000-memory.dmp

Filesize
1.7MB

Download
memory/1536-64-0x0000000000000000-mapping.dmp

Download
memory/1536-67-0x0000000000090000-0x0000000000098000-memory.dmp

Filesize
32KB

Download
memory/1536-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1536-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1972-55-0x0000000076C81000-0x0000000076C83000-memory.dmp

Filesize
8KB

Download
memory/1972-54-0x0000000000000000-mapping.dmp

Download
memory/1972-58-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1972-56-0x0000000001D80000-0x0000000002218000-memory.dmp

Filesize
4.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads