remcos | 3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3

General

Target

wininit.exe
Size

1.3MB
MD5

290102d5e403f9eb6d7cd7fe3188d307
SHA1

bac36c2536721592ebcac74a88c50b00fab67e5a
SHA256

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3
SHA512

9f8f0ba6d4c81541a2aa55a3f5c5d63eaab1fe1dca8c98e26e4c605b5dc4ce734dff6656f139cbac73c0d753939964af28dc5f2b0d09e03da4361dc65f35a556
SSDEEP

24576:6AHnh+eWsN3skA4RV1Hom2KXMmHal8/L5Sq6C/pWPxGgp5:Nh+ZkldoPK8Yal8FS5j

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Drops startup file 1 IoCs

Processes:

chrome.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs chrome.exe
Executes dropped EXE 1 IoCs

Processes:

chrome.exe

pid process

3528 chrome.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs	chrome.exe

pid	process
3528	chrome.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\directory\chrome.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chrome.exe

description pid process target process

PID 3528 set thread context of 3516 3528 chrome.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

chrome.exe

pid process

3528 chrome.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

wininit.exechrome.exe

pid process

3728 wininit.exe
3728 wininit.exe
3528 chrome.exe
3528 chrome.exe
3528 chrome.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

wininit.exechrome.exe

pid process

3728 wininit.exe
3728 wininit.exe
3528 chrome.exe
3528 chrome.exe
3528 chrome.exe

description	pid	process	target process
PID 3528 set thread context of 3516	3528	chrome.exe	svchost.exe

pid	process
3528	chrome.exe

pid	process
3728	wininit.exe
3728	wininit.exe
3528	chrome.exe
3528	chrome.exe
3528	chrome.exe

pid	process
3728	wininit.exe
3728	wininit.exe
3528	chrome.exe
3528	chrome.exe
3528	chrome.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

wininit.exechrome.exe

description	pid	process	target process
PID 3728 wrote to memory of 3528	3728	wininit.exe	chrome.exe
PID 3728 wrote to memory of 3528	3728	wininit.exe	chrome.exe
PID 3728 wrote to memory of 3528	3728	wininit.exe	chrome.exe
PID 3528 wrote to memory of 3516	3528	chrome.exe	svchost.exe
PID 3528 wrote to memory of 3516	3528	chrome.exe	svchost.exe
PID 3528 wrote to memory of 3516	3528	chrome.exe	svchost.exe
PID 3528 wrote to memory of 3516	3528	chrome.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\wininit.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728

C:\Users\Admin\AppData\Local\directory\chrome.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
3⤵
PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\outvaunts
Filesize
29KB

MD5
a5aafcbb781d0c5b2f340a29d0629577

SHA1
5885120f4413bf4256b9722c71982785f741131f

SHA256
fd31cbc5b26cd67d16c85a091779f0af58db13a956d3dc6da79d7822f8ea02cd

SHA512
9cae262aa54357bae92fa09c3fcfbb964df079d391747ef2f3673c3903e19b4f1cb5df85cf78cf8a5ba1d33614e766a4e059fd3681ae4c47a65c750e3b3b8a38

Download Submit
C:\Users\Admin\AppData\Local\Temp\unprickly
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\directory\chrome.exe
Filesize
106.3MB

MD5
224f7a722d220a59cdaea224e1a535ed

SHA1
406453ff728abce6d188150d19c4c3f8ee1fa89d

SHA256
f405233a645648ba30f744ce00680dab3d7495f931b8fbddd46050098d62e9cc

SHA512
12b0994486af3389486f576bcb65e52eeb566c8524d63520e9c9b695119a7eb2a0627e40b6e6a453c71a7c13ae38c601c9aea66b9c5b4ae93d74129eb83d2dc7

Download Submit
memory/3516-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3516-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3728-10-0x00000000018A0000-0x00000000018A4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing