remcos | c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95

General

Target

Results.exe
Size

320KB
MD5

95312ffb418f599490bcfbe0ec0d79fd
SHA1

142960086945f1e2b00027d659a0a149eee6414c
SHA256

c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95
SHA512

9df9db299fc216d98e3d28fef9abb0cf217bad3ac2241c004b6e789d7c27a9a8c1305aa68a876561a646ad303b69d55c957450b0a4b5c2da0e70df59565ce140

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.3.2 Pro

Botnet

RemoteHost

C2

generem.hopto.org:2404

generem1.hopto.org:2404

hendersonk.hopto.org:2404

hendersonk1.hopto.org:2404

gene.ddnsgeek.com:2404

henderson.camdvr.org:2404

henderson1.camdvr.org:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
MediaGallery-7W4I14
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Downloads MZ/PE file
Suspicious use of SetThreadContext 1 IoCs

Processes:

Results.exe

description pid process target process

PID 3600 set thread context of 4224 3600 Results.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Results.exe

pid process

3600 Results.exe
3600 Results.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegAsm.exe

pid process

4224 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Results.exe

description pid process

Token: SeDebugPrivilege 3600 Results.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

4224 RegAsm.exe

description	pid	process	target process
PID 3600 set thread context of 4224	3600	Results.exe	RegAsm.exe

pid	process
3600	Results.exe
3600	Results.exe

pid	process
4224	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3600	Results.exe

pid	process
4224	RegAsm.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Results.exe

description	pid	process	target process
PID 3600 wrote to memory of 4232	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4232	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4232	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe
PID 3600 wrote to memory of 4224	3600	Results.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Results.exe
"C:\Users\Admin\AppData\Local\Temp\Results.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3600-115-0x0000000000E20000-0x0000000000E76000-memory.dmp

Filesize
344KB

Download
memory/3600-116-0x0000000005BC0000-0x00000000060BE000-memory.dmp

Filesize
5.0MB

Download
memory/3600-117-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/3600-118-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/3600-119-0x00000000056C0000-0x00000000056CA000-memory.dmp

Filesize
40KB

Download
memory/3600-120-0x0000000005683000-0x0000000005685000-memory.dmp

Filesize
8KB

Download
memory/3600-121-0x0000000009590000-0x00000000095DC000-memory.dmp

Filesize
304KB

Download
memory/4224-122-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4224-123-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4224-124-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing