remcos | 5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43

General

Target

5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe
Size

280KB
MD5

64300f6fbcdb63dd91ba0f477a21afb6
SHA1

88afaf95485f44c83dd0ae1efd75775d4da07146
SHA256

5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43
SHA512

fcccfcc63042f32a4bfcd449dc2769581d572c2ac8e06af0e4ffc2fc17e8be57c829cebf82fdbdf5246ced4725ffff89d71378492b17b6a7845bf042165dfe2c

Score

10^/10

remcos c.d.t-3xp101t3d rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

C.D.T-3XP101T3D

C2

systen32.ddns.net:2404

office365update.duckdns.org:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_mICROSOFTwINDOWSuPDAT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
AAAAAABooking
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
true
take_screenshot_time
7
take_screenshot_title
authenticate

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 2 IoCs

Processes:

5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exeMSBuild.exe

description	pid	process	target process
PID 3328 set thread context of 1740	3328	5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe	MSBuild.exe
PID 1740 set thread context of 2620	1740	MSBuild.exe	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 1740 MSBuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

2620 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1740	MSBuild.exe

pid	process
2620	MSBuild.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exeMSBuild.exe

description	pid	process	target process
PID 3328 wrote to memory of 1740	3328	5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe	MSBuild.exe
PID 3328 wrote to memory of 1740	3328	5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe	MSBuild.exe
PID 3328 wrote to memory of 1740	3328	5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe	MSBuild.exe
PID 3328 wrote to memory of 1740	3328	5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe	MSBuild.exe
PID 3328 wrote to memory of 1740	3328	5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe	MSBuild.exe
PID 3328 wrote to memory of 1740	3328	5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe	MSBuild.exe
PID 3328 wrote to memory of 1740	3328	5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe	MSBuild.exe
PID 3328 wrote to memory of 1740	3328	5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe
PID 1740 wrote to memory of 2620	1740	MSBuild.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe
"C:\Users\Admin\AppData\Local\Temp\5370711dd45b84b9644b635d03baad08d75ff740364e93ed023adc9c4a297c43.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3328

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
3⤵
- Suspicious use of SetWindowsHookEx
PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-119-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1740-120-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/2620-121-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2620-122-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3328-118-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing