remcos | 3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3

General

Target

wininit.exe
Size

1.3MB
MD5

290102d5e403f9eb6d7cd7fe3188d307
SHA1

bac36c2536721592ebcac74a88c50b00fab67e5a
SHA256

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3
SHA512

9f8f0ba6d4c81541a2aa55a3f5c5d63eaab1fe1dca8c98e26e4c605b5dc4ce734dff6656f139cbac73c0d753939964af28dc5f2b0d09e03da4361dc65f35a556
SSDEEP

24576:6AHnh+eWsN3skA4RV1Hom2KXMmHal8/L5Sq6C/pWPxGgp5:Nh+ZkldoPK8Yal8FS5j

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Drops startup file 1 IoCs

Processes:

chrome.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs chrome.exe
Executes dropped EXE 1 IoCs

Processes:

chrome.exe

pid process

3004 chrome.exe
Loads dropped DLL 1 IoCs

Processes:

wininit.exe

pid process

2176 wininit.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs	chrome.exe

pid	process
3004	chrome.exe

pid	process
2176	wininit.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\directory\chrome.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chrome.exe

description pid process target process

PID 3004 set thread context of 2504 3004 chrome.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

chrome.exe

pid process

3004 chrome.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

wininit.exechrome.exe

pid process

2176 wininit.exe
2176 wininit.exe
3004 chrome.exe
3004 chrome.exe
3004 chrome.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

wininit.exechrome.exe

pid process

2176 wininit.exe
2176 wininit.exe
3004 chrome.exe
3004 chrome.exe
3004 chrome.exe

description	pid	process	target process
PID 3004 set thread context of 2504	3004	chrome.exe	svchost.exe

pid	process
3004	chrome.exe

pid	process
2176	wininit.exe
2176	wininit.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

pid	process
2176	wininit.exe
2176	wininit.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

wininit.exechrome.exe

description	pid	process	target process
PID 2176 wrote to memory of 3004	2176	wininit.exe	chrome.exe
PID 2176 wrote to memory of 3004	2176	wininit.exe	chrome.exe
PID 2176 wrote to memory of 3004	2176	wininit.exe	chrome.exe
PID 2176 wrote to memory of 3004	2176	wininit.exe	chrome.exe
PID 3004 wrote to memory of 2504	3004	chrome.exe	svchost.exe
PID 3004 wrote to memory of 2504	3004	chrome.exe	svchost.exe
PID 3004 wrote to memory of 2504	3004	chrome.exe	svchost.exe
PID 3004 wrote to memory of 2504	3004	chrome.exe	svchost.exe
PID 3004 wrote to memory of 2504	3004	chrome.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\wininit.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\directory\chrome.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
3⤵
PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\outvaunts
Filesize
29KB

MD5
a5aafcbb781d0c5b2f340a29d0629577

SHA1
5885120f4413bf4256b9722c71982785f741131f

SHA256
fd31cbc5b26cd67d16c85a091779f0af58db13a956d3dc6da79d7822f8ea02cd

SHA512
9cae262aa54357bae92fa09c3fcfbb964df079d391747ef2f3673c3903e19b4f1cb5df85cf78cf8a5ba1d33614e766a4e059fd3681ae4c47a65c750e3b3b8a38

Download Submit
C:\Users\Admin\AppData\Local\Temp\unprickly
Filesize
483KB

MD5
59aa802af60e63fe7d976d2230c8710c

SHA1
f105fac10d095b5019a048a39e666586536a30a1

SHA256
a635bcea499830d578743018ea6841affb8ab25588c8650c9d4ff2a0cbd01236

SHA512
36362896bba93b76869ae5eb6e57a1f4f11a3a6ddbb2a28de0909c870cb44006acf077edc07b8def18b3fd23215973f080c0aa9fde4635e783689c57ac3b0fb4

Download Submit
\Users\Admin\AppData\Local\directory\chrome.exe
Filesize
107.3MB

MD5
9c9bc0f60c893f24dc8611945dde65e0

SHA1
6205e71edbffa0eb7b9d05ef1a86b26c0af10bad

SHA256
b147a687fe5f158bb3378005e4f1e5c1a04543039952ef894a49b876b06b19f6

SHA512
061ba4126cb51adc33c3d567e208d8ca5c46cffb8093a6a87edee2e6973cfac840ef97325dba7da74d6b6a6935a58db894f4391ef73b00ddb09749a58030531d

Download Submit
memory/2176-10-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download
memory/2504-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2504-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing