remcos | 3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3

General

Target

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
Size

1.3MB
MD5

290102d5e403f9eb6d7cd7fe3188d307
SHA1

bac36c2536721592ebcac74a88c50b00fab67e5a
SHA256

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3
SHA512

9f8f0ba6d4c81541a2aa55a3f5c5d63eaab1fe1dca8c98e26e4c605b5dc4ce734dff6656f139cbac73c0d753939964af28dc5f2b0d09e03da4361dc65f35a556
SSDEEP

24576:6AHnh+eWsN3skA4RV1Hom2KXMmHal8/L5Sq6C/pWPxGgp5:Nh+ZkldoPK8Yal8FS5j

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 30 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2288-30-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-32-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-33-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-34-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-35-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-36-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-37-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-38-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-39-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-41-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-42-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-43-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-44-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-45-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-47-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-46-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-48-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-49-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-50-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-51-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-53-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-54-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-55-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-56-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-57-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-58-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-59-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-60-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-61-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2288-63-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Drops startup file 1 IoCs

Processes:

chrome.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs chrome.exe
Executes dropped EXE 1 IoCs

Processes:

chrome.exe

pid process

3036 chrome.exe
Loads dropped DLL 1 IoCs

Processes:

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe

pid process

1092 3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs	chrome.exe

pid	process
3036	chrome.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\directory\chrome.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chrome.exe

description pid process target process

PID 3036 set thread context of 2288 3036 chrome.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

chrome.exe

pid process

3036 chrome.exe

description	pid	process	target process
PID 3036 set thread context of 2288	3036	chrome.exe	svchost.exe

pid	process
3036	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exechrome.exe

pid	process
1092	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
1092	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exechrome.exe

pid	process
1092	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
1092	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exechrome.exe

description	pid	process	target process
PID 1092 wrote to memory of 3036	1092	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe	chrome.exe
PID 1092 wrote to memory of 3036	1092	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe	chrome.exe
PID 1092 wrote to memory of 3036	1092	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe	chrome.exe
PID 1092 wrote to memory of 3036	1092	3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe	chrome.exe
PID 3036 wrote to memory of 2288	3036	chrome.exe	svchost.exe
PID 3036 wrote to memory of 2288	3036	chrome.exe	svchost.exe
PID 3036 wrote to memory of 2288	3036	chrome.exe	svchost.exe
PID 3036 wrote to memory of 2288	3036	chrome.exe	svchost.exe
PID 3036 wrote to memory of 2288	3036	chrome.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe
"C:\Users\Admin\AppData\Local\Temp\3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\directory\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3.exe"
    3⤵
    PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\outvaunts

Filesize
29KB

MD5
a5aafcbb781d0c5b2f340a29d0629577

SHA1
5885120f4413bf4256b9722c71982785f741131f

SHA256
fd31cbc5b26cd67d16c85a091779f0af58db13a956d3dc6da79d7822f8ea02cd

SHA512
9cae262aa54357bae92fa09c3fcfbb964df079d391747ef2f3673c3903e19b4f1cb5df85cf78cf8a5ba1d33614e766a4e059fd3681ae4c47a65c750e3b3b8a38

Download Submit
C:\Users\Admin\AppData\Local\Temp\unprickly

Filesize
483KB

MD5
59aa802af60e63fe7d976d2230c8710c

SHA1
f105fac10d095b5019a048a39e666586536a30a1

SHA256
a635bcea499830d578743018ea6841affb8ab25588c8650c9d4ff2a0cbd01236

SHA512
36362896bba93b76869ae5eb6e57a1f4f11a3a6ddbb2a28de0909c870cb44006acf077edc07b8def18b3fd23215973f080c0aa9fde4635e783689c57ac3b0fb4

Download Submit
\Users\Admin\AppData\Local\directory\chrome.exe

Filesize
104.3MB

MD5
2cad1ea2a8feb308706348ddc16e1cdc

SHA1
486ac7f411b90be81fe246fc16b93904cc95f7aa

SHA256
0173da8df43aac4427c9702a1013f5f0accf7f6c3ea7392052d168bd81722965

SHA512
739b156f959a7562671414bc9ce8b8d27f4003e39f07970a71f2249db668afc709e6051572335b545303dae2c1c813ffb6cff2d45a772f2e2ee670de60a97e3e

Download Submit
memory/1092-10-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download
memory/2288-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-53-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads