remcos | 0cc48aff53488b65a76db7c4c4cb517865dfe121fee9b347462463ea4ba8870b

General

Target

RQKH08765434560780098765.exe
Size

405KB
MD5

d24341052b9c2846ce4ded275ca8945c
SHA1

1b17684788b42c5bd981750d49b13d64cdc8e90a
SHA256

831e7dcf43daa00beb78eb3d0afc5d67fed17aaecb04eb1e7267295d648acb8e
SHA512

df87ed0e9164ee4d348ad79af48e31d513deb5f7ebc67c7a5e8f61b0c577d2bfc2ad80f63bd9cdf537846a3d296268db22fde81aa5e2e187d47dc54c0733f7a7

Score

10^/10

remcos host rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

185.222.57.90:8780

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_rllxnwmcxxgutsl
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Loads dropped DLL 1 IoCs

Processes:

RQKH08765434560780098765.exe

pid process

1588 RQKH08765434560780098765.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

RQKH08765434560780098765.exe

description pid process target process

PID 1588 set thread context of 556 1588 RQKH08765434560780098765.exe RQKH08765434560780098765.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RQKH08765434560780098765.exe

pid process

556 RQKH08765434560780098765.exe

pid	process
1588	RQKH08765434560780098765.exe

description	pid	process	target process
PID 1588 set thread context of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe

pid	process
556	RQKH08765434560780098765.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

RQKH08765434560780098765.exe

description	pid	process	target process
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe
PID 1588 wrote to memory of 556	1588	RQKH08765434560780098765.exe	RQKH08765434560780098765.exe

C:\Users\Admin\AppData\Local\Temp\RQKH08765434560780098765.exe
"C:\Users\Admin\AppData\Local\Temp\RQKH08765434560780098765.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\RQKH08765434560780098765.exe
"C:\Users\Admin\AppData\Local\Temp\RQKH08765434560780098765.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstEF0.tmp\ueyw.dll
MD5
a21aa0019729f13fa73f7c58c4a9e79b

SHA1
eb7210b344a100b0ed20c05868833bd7beed49b4

SHA256
db4b3114ec2471c0acc88542aba11bfd48cd8ccf6c52ebc116e79aabdfbe6d34

SHA512
e6ce5ce7c7cdfda1d1573a2b42e579ff0f73d26d07e36ddb4193fc91c32930d5a006526c77eb8ef78195eb86fb57b78dd7655c391adf8f6c2600e173fe673ac8

Download Submit
memory/556-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/556-58-0x000000000040FD88-mapping.dmp

Download
memory/556-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1588-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing