remcos | 9127f887ce2cedcbf1c410e431efe9e7f388fbe04e4cadb6c7451545a151fe7b

General

Target

3.exe
Size

358KB
MD5

e8e41fd0c3f4b307c5b8cea610ae2f90
SHA1

da24cfc46900a33027575ccb5b741aae2a5c610c
SHA256

9127f887ce2cedcbf1c410e431efe9e7f388fbe04e4cadb6c7451545a151fe7b
SHA512

05db528be036fd65a3c520eff32878670b186dbdffdc9477b5a5772a8d43a58928d88f5ae48e0fbf5a80aa0712277dfb26f7b25d41a1e12ef74b969b8ad87501

Score

10^/10

remcos host rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

185.222.57.90:8780

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_rllxnwmcxxgutsl
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Loads dropped DLL 1 IoCs

Processes:

3.exe

pid process

1552 3.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

3.exe

description pid process target process

PID 1552 set thread context of 1328 1552 3.exe 3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3.exe

pid process

1328 3.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3.exe

pid process

1328 3.exe

pid	process
1552	3.exe

description	pid	process	target process
PID 1552 set thread context of 1328	1552	3.exe	3.exe

pid	process
1328	3.exe

pid	process
1328	3.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3.exe

description	pid	process	target process
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe
PID 1552 wrote to memory of 1328	1552	3.exe	3.exe

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1552

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsyC025.tmp\sxlxafjdl.dll
MD5
459ccf9db3e880db4bd97a275101c92f

SHA1
57c90985e37903d97a19710c93bc836622643cf3

SHA256
80d6cfe595eb1acded67a063ee3b292779e2dcc2f24a47cf5434d7cf70bbde3a

SHA512
84186df587f4fa4b05019e2583f4cc6fc00067bbc604e14169795502ed5df9c43179a41960b76745dabc9776efc811eec436c7af2c203cfcce2f744e8221e34a

Download Submit
memory/1328-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1328-58-0x000000000040FD88-mapping.dmp

Download
memory/1328-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1552-55-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing