remcos | c9a855a5da51e96ec9c3c59f6331939b49bbdee2d9309f61ce92e326abdb3895

Analysis

max time kernel
150s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
12/11/2020, 06:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rbmmuoavjkz8.exe
Size 1.2MB
Sample201112-4zdwhgymtx
SHA256 c9a855a5da51e96ec9c3c59f6331939b49bbdee2d9309f61ce92e326abdb3895
MD5 92a24000ceaaf6dfffe49237ce46c711
SHA1 8ddd627b8f77d01d3f20541e66c43f6196573e12
SHA512 6ecb7e65b795f7bc4984d2b6b5a4b622d7d3979d24ce414e6373e58ad834b1161870489ab5efe5c8edfa7ce1b8ff31e06ee8e3ba067a24c7d68dd80cf8504128
MD5 SHA1 SHA512

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

latua.nsupdate.info:7722
fanta.nsupdate.info:7722
coke.nsupdate.info:7722

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 4060	2268	Rbmmuoavjkz8.exe	78

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	Rbmmuoavjkz8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4060	Rbmmuoavjkz8.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78
PID 2268 wrote to memory of 4060	2268	Rbmmuoavjkz8.exe	78

C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe
"C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe
  "C:\Users\Admin\AppData\Local\Temp\Rbmmuoavjkz8.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x0000000074050000-0x000000007473E000-memory.dmp

Download

memory/2268-1-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/2268-3-0x0000000005440000-0x0000000005482000-memory.dmp

Download

memory/2268-4-0x0000000005590000-0x00000000055A6000-memory.dmp

Download

memory/4060-5-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4060-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads