remcos | 3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3

General

Target

wininit.exe
Size

1.3MB
MD5

290102d5e403f9eb6d7cd7fe3188d307
SHA1

bac36c2536721592ebcac74a88c50b00fab67e5a
SHA256

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3
SHA512

9f8f0ba6d4c81541a2aa55a3f5c5d63eaab1fe1dca8c98e26e4c605b5dc4ce734dff6656f139cbac73c0d753939964af28dc5f2b0d09e03da4361dc65f35a556
SSDEEP

24576:6AHnh+eWsN3skA4RV1Hom2KXMmHal8/L5Sq6C/pWPxGgp5:Nh+ZkldoPK8Yal8FS5j

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Drops startup file 1 IoCs

Processes:

chrome.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs chrome.exe
Executes dropped EXE 1 IoCs

Processes:

chrome.exe

pid process

4164 chrome.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs	chrome.exe

pid	process
4164	chrome.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\directory\chrome.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chrome.exe

description pid process target process

PID 4164 set thread context of 560 4164 chrome.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

chrome.exe

pid process

4164 chrome.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

wininit.exechrome.exe

pid process

5080 wininit.exe
5080 wininit.exe
4164 chrome.exe
4164 chrome.exe
4164 chrome.exe
4164 chrome.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

wininit.exechrome.exe

pid process

5080 wininit.exe
5080 wininit.exe
4164 chrome.exe
4164 chrome.exe
4164 chrome.exe
4164 chrome.exe

description	pid	process	target process
PID 4164 set thread context of 560	4164	chrome.exe	svchost.exe

pid	process
4164	chrome.exe

pid	process
5080	wininit.exe
5080	wininit.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe

pid	process
5080	wininit.exe
5080	wininit.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

wininit.exechrome.exe

description	pid	process	target process
PID 5080 wrote to memory of 4164	5080	wininit.exe	chrome.exe
PID 5080 wrote to memory of 4164	5080	wininit.exe	chrome.exe
PID 5080 wrote to memory of 4164	5080	wininit.exe	chrome.exe
PID 4164 wrote to memory of 560	4164	chrome.exe	svchost.exe
PID 4164 wrote to memory of 560	4164	chrome.exe	svchost.exe
PID 4164 wrote to memory of 560	4164	chrome.exe	svchost.exe
PID 4164 wrote to memory of 560	4164	chrome.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\wininit.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080

C:\Users\Admin\AppData\Local\directory\chrome.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
3⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2632 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:8
1⤵
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\outvaunts
Filesize
29KB

MD5
a5aafcbb781d0c5b2f340a29d0629577

SHA1
5885120f4413bf4256b9722c71982785f741131f

SHA256
fd31cbc5b26cd67d16c85a091779f0af58db13a956d3dc6da79d7822f8ea02cd

SHA512
9cae262aa54357bae92fa09c3fcfbb964df079d391747ef2f3673c3903e19b4f1cb5df85cf78cf8a5ba1d33614e766a4e059fd3681ae4c47a65c750e3b3b8a38

Download Submit
C:\Users\Admin\AppData\Local\Temp\unprickly
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\directory\chrome.exe
Filesize
111.3MB

MD5
0c742b2ab747dc6f86b3bff7de1ae764

SHA1
78c282efac27b6dd5494c80baf0a3657e6f539e6

SHA256
6b617c295a1cd7da379412e407ca785afa6392fd5e2b07619d15e1d0502089cd

SHA512
be74920d7c9b843b4b85593e9fd27754e5705bda971f3e93e68ce10132906c1d8e7d89f626ed7fd35b2c7fd2be11c33d2e78acdb4b9bcc5ba761cfca6042359d

Download Submit
memory/560-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/560-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5080-10-0x00000000040B0000-0x00000000040B4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing