remcos | 3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3

Analysis

max time kernel
150s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20240319-en
resource tags

arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system
submitted
08/04/2024, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
Size 1.3MB
Sample240408-rrx64sbc42
SHA256 3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3
MD5 290102d5e403f9eb6d7cd7fe3188d307
SHA1 bac36c2536721592ebcac74a88c50b00fab67e5a
SHA512 9f8f0ba6d4c81541a2aa55a3f5c5d63eaab1fe1dca8c98e26e4c605b5dc4ce734dff6656f139cbac73c0d753939964af28dc5f2b0d09e03da4361dc65f35a556
SSDEEP 24576:6AHnh+eWsN3skA4RV1Hom2KXMmHal8/L5Sq6C/pWPxGgp5:Nh+ZkldoPK8Yal8FS5j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
1868	chrome.exe
4512	chrome.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000029d0e-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4512 set thread context of 4784	4512	chrome.exe	84

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1868	chrome.exe
4512	chrome.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2404	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
2404	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
1868	chrome.exe
1868	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2404	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
2404	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
1868	chrome.exe
1868	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1868	2404	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe	81
PID 2404 wrote to memory of 1868	2404	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe	81
PID 2404 wrote to memory of 1868	2404	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe	81
PID 1868 wrote to memory of 4912	1868	chrome.exe	82
PID 1868 wrote to memory of 4912	1868	chrome.exe	82
PID 1868 wrote to memory of 4912	1868	chrome.exe	82
PID 1868 wrote to memory of 4512	1868	chrome.exe	83
PID 1868 wrote to memory of 4512	1868	chrome.exe	83
PID 1868 wrote to memory of 4512	1868	chrome.exe	83
PID 4512 wrote to memory of 4784	4512	chrome.exe	84
PID 4512 wrote to memory of 4784	4512	chrome.exe	84
PID 4512 wrote to memory of 4784	4512	chrome.exe	84
PID 4512 wrote to memory of 4784	4512	chrome.exe	84

C:\Users\Admin\AppData\Local\Temp\3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
"C:\Users\Admin\AppData\Local\Temp\3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\directory\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe"
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Local\directory\chrome.exe
    "C:\Users\Admin\AppData\Local\directory\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\directory\chrome.exe"
      4⤵
      PID:4784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

aut9C4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut9C4F.tmp
Size 427KB
SHA256 afe6f0eed2587490b8b3b4e4cf4c91f164e36ae30362cae0c8590ce75017b71c
MD5 67a12002d897c143f0579edef1ee5be4
SHA1 938632453bd4ea67cc02846b146c340a34c6f2d6
SHA512 65b4df0c1392109b8814c145b2ea903197f0c577bb386f066cb494452f9976af5f5501578c4b44730d85516e9bea9199e1fe3773115134abaf94cb26ba48660d
SSDEEP 12288:HizacF1YsNpiJipTVoX5iKRESYI8XVxFReH:C+cF8YpTeJ/6XVxFRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

autA3A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\autA3A3.tmp
Size 9KB
SHA256 3eda6ff9b8a63b458b00ba458259dfa35cf26bb277761e48d6697e4c855121be
MD5 16a82b0d4f256a21cb79a9442188dcf3
SHA1 4c539edfa7ac6ba59620a4babff966c8507bed14
SHA512 2e1173703ff0d9b5f859bfaab8bf897c24b8ec590869624933327a52e87a74a18967c90605ff17ffa2e2674e3b623c3bc901555c2b8fd0f557990e804d103c36
SSDEEP 192:9yaFcKcf7r+mTg5ajR1eRnSRdsN7QAculeUfYqo34P1R:TF7c/+mRRAdSRdsCUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

outvaunts

Path C:\Users\Admin\AppData\Local\Temp\outvaunts
Size 29KB
SHA256 fd31cbc5b26cd67d16c85a091779f0af58db13a956d3dc6da79d7822f8ea02cd
MD5 a5aafcbb781d0c5b2f340a29d0629577
SHA1 5885120f4413bf4256b9722c71982785f741131f
SHA512 9cae262aa54357bae92fa09c3fcfbb964df079d391747ef2f3673c3903e19b4f1cb5df85cf78cf8a5ba1d33614e766a4e059fd3681ae4c47a65c750e3b3b8a38
SSDEEP 768:AiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbeE+IPTxb4vfF3if6gyh:AiTZ+2QoioGRk6ZklputwjpjBkCiw2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

unprickly

Path C:\Users\Admin\AppData\Local\Temp\unprickly
Size 192KB
SHA256 aca21122a4a9617e96844f08c3036780485fbe727bf28168482c750727c587fd
MD5 cf8862c59ffea18bbdf06c45734f0340
SHA1 ac4b045dee3e20770571aeff7dcbd83493b6ad6b
SHA512 355f0675e573e4c8b6c32ab222918daa41b6f35375e8124a0af91011381058be36b30a23f06ecb802b91941fb9998ac87e193eb58d879171a686960c39995edc
SSDEEP 3072:IwAEzHxEv61T95Q7AIdUglxARiT1bYl13Nfh+Hqo1mU2Oe6SM9vbISli59+VL+5H:IwAErev6t95/ILMH3duvUUifMdDlW4+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

unprickly

Path C:\Users\Admin\AppData\Local\Temp\unprickly
Size 483KB
SHA256 a635bcea499830d578743018ea6841affb8ab25588c8650c9d4ff2a0cbd01236
MD5 59aa802af60e63fe7d976d2230c8710c
SHA1 f105fac10d095b5019a048a39e666586536a30a1
SHA512 36362896bba93b76869ae5eb6e57a1f4f11a3a6ddbb2a28de0909c870cb44006acf077edc07b8def18b3fd23215973f080c0aa9fde4635e783689c57ac3b0fb4
SSDEEP 6144:IwAErev6t95/ILMH3duvUUifMdDlW4+5FqYQS1IjYdVd+NP0rQnKc1MU3JPVpWdz:pXzbQLMHktOFqYigGPpK+5PVp/fy3p
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\directory\chrome.exe
Size 110.3MB
SHA256 720191437118771790b86d094d355c5f19d5cbabd41b275b53fd2aa24d7f6a80
MD5 6f74e1ff0533083646edbda5b9c08cb5
SHA1 6275a08d08f59a591ac6fda7e0411d81291110e6
SHA512 d22a0b94391c3467da4666f05ce0ef6adf2854a208795c84217b24b4456c5c84bf5a73e25d3e636bd91078d78d1647a6a61a45ecdbcd330f22e5addc10461a3a
SSDEEP 24576:6AHnh+eWsN3skA4RV1Hom2KXMmHal8/L5Sq6C/pWPxGgp5YrXzpnpOfaW3y:Nh+ZkldoPK8Yal8FS5jYdnpOiey
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2404-10-0x0000000004600000-0x0000000004604000-memory.dmp

Download

memory/4784-46-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-49-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-43-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-45-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-41-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-47-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-48-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-42-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-52-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-53-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-54-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-55-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-57-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-58-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-59-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4784-60-0x0000000000400000-0x0000000000482000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads