remcos | c392c14304399e9ad13ede370375ecffa47f30245cb91a413a3fd1150721a929

General

Target

wininit (1).exe
Size

1.3MB
MD5

6b7314e8a04ad8436c3aff06f3918ea6
SHA1

61c5aca05c76396e70054b732d9afb7d4a5e293d
SHA256

c392c14304399e9ad13ede370375ecffa47f30245cb91a413a3fd1150721a929
SHA512

00b5c837c36cb44d5b1a7c724746daf85b4a1d4b89d55a2d81e8999ed34035baa84a8f9fc976704ec92afe52a316c09eb7b7d012d66d8d5eea284d31d5974baf
SSDEEP

24576:LAHnh+eWsN3skA4RV1Hom2KXMmHaUCTOhtduicYukHxavC55:mh+ZkldoPK8YaUC6h/qg

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Drops startup file 1 IoCs

Processes:

excel.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\excel.vbs excel.exe
Executes dropped EXE 1 IoCs

Processes:

excel.exe

pid process

852 excel.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\excel.vbs	excel.exe

pid	process
852	excel.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\directory\excel.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

excel.exe

description pid process target process

PID 852 set thread context of 2292 852 excel.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

excel.exe

pid process

852 excel.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

wininit (1).exeexcel.exe

pid process

4920 wininit (1).exe
4920 wininit (1).exe
852 excel.exe
852 excel.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

wininit (1).exeexcel.exe

pid process

4920 wininit (1).exe
4920 wininit (1).exe
852 excel.exe
852 excel.exe

description	pid	process	target process
PID 852 set thread context of 2292	852	excel.exe	svchost.exe

pid	process
852	excel.exe

pid	process
4920	wininit (1).exe
4920	wininit (1).exe
852	excel.exe
852	excel.exe

pid	process
4920	wininit (1).exe
4920	wininit (1).exe
852	excel.exe
852	excel.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

wininit (1).exeexcel.exe

description	pid	process	target process
PID 4920 wrote to memory of 852	4920	wininit (1).exe	excel.exe
PID 4920 wrote to memory of 852	4920	wininit (1).exe	excel.exe
PID 4920 wrote to memory of 852	4920	wininit (1).exe	excel.exe
PID 852 wrote to memory of 2292	852	excel.exe	svchost.exe
PID 852 wrote to memory of 2292	852	excel.exe	svchost.exe
PID 852 wrote to memory of 2292	852	excel.exe	svchost.exe
PID 852 wrote to memory of 2292	852	excel.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\wininit (1).exe
"C:\Users\Admin\AppData\Local\Temp\wininit (1).exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920

C:\Users\Admin\AppData\Local\directory\excel.exe
"C:\Users\Admin\AppData\Local\Temp\wininit (1).exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\wininit (1).exe"
3⤵
PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Thebit

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\directory\excel.exe

Filesize
101.3MB

MD5
f31d9ee063f3c0e695119c2001526eba

SHA1
318f611a1cc6ea1acfd90e7c96a25c8a296cb98f

SHA256
f123ce5c0da540eeb18ed45e16e3560e7d5071e857ae8cb6c551d1274232a298

SHA512
6bfbdb053b3af17799a15a2eec16be828af3c7f05f9600e510e0d3d01b0c9cfee282cc309d2f615356aa0c45ab261a9bc62d363db5211a7cf778c069d69702a4

Download Submit
memory/2292-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2292-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4920-10-0x0000000003AC0000-0x0000000003AC4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing