remcos | 4a024542511c7d0a40e8317486b7177eaf71ee355f1731f17bc632731ea814b0

General

Target
c8cd2d9e8f9ac669acd4fc594cd7db3a.exe
Size 387KB
Sample201015-9fdc8t7tnx
SHA256 4a024542511c7d0a40e8317486b7177eaf71ee355f1731f17bc632731ea814b0
MD5 c8cd2d9e8f9ac669acd4fc594cd7db3a
SHA1 0f538bce74d482a4f773c36f64de0f989f2e0ea1
SHA512 54cce926a049855e6c1d3d80acd762db234d37f748069104549e7f0a43e4ee414feafbf80153c83e53c39c4fdddd34a308b3113ff2111d5dc6db062812e6b8ed
MD5 SHA1 SHA512

Score

10^/10

rat remcos

Malware Config

Extracted

Family

remcos

C2

160.20.147.120:2404

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 316 set thread context of 1576	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	30

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe
316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe
316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1584	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	28
PID 316 wrote to memory of 1584	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	28
PID 316 wrote to memory of 1584	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	28
PID 316 wrote to memory of 1584	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	28
PID 316 wrote to memory of 1584	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	28
PID 316 wrote to memory of 1584	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	28
PID 316 wrote to memory of 1584	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	28
PID 316 wrote to memory of 1676	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	29
PID 316 wrote to memory of 1676	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	29
PID 316 wrote to memory of 1676	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	29
PID 316 wrote to memory of 1676	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	29
PID 316 wrote to memory of 1676	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	29
PID 316 wrote to memory of 1676	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	29
PID 316 wrote to memory of 1676	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	29
PID 316 wrote to memory of 1576	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	30
PID 316 wrote to memory of 1576	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	30
PID 316 wrote to memory of 1576	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	30
PID 316 wrote to memory of 1576	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	30
PID 316 wrote to memory of 1576	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	30
PID 316 wrote to memory of 1576	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	30
PID 316 wrote to memory of 1576	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	30
PID 316 wrote to memory of 1576	316	c8cd2d9e8f9ac669acd4fc594cd7db3a.exe	30

C:\Users\Admin\AppData\Local\Temp\c8cd2d9e8f9ac669acd4fc594cd7db3a.exe
"C:\Users\Admin\AppData\Local\Temp\c8cd2d9e8f9ac669acd4fc594cd7db3a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-0-0x0000000074B10000-0x00000000751FE000-memory.dmp

Download

memory/316-1-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/316-3-0x00000000046D0000-0x00000000046F7000-memory.dmp

Download

memory/316-5-0x0000000000AE0000-0x0000000000B00000-memory.dmp

Download

memory/1576-9-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1576-11-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads