remcos | 451ab9846f3c63a6b5f2e25ab5f58bb4180cf414062f52e280bd98eafea81963

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09/05/2022, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ENQUIRY 20220509.exe
Size 764KB
Sample220509-gtqvpscdg2
SHA256 451ab9846f3c63a6b5f2e25ab5f58bb4180cf414062f52e280bd98eafea81963
MD5 3e974bea23a847c95bbab2f99b9dffa1
SHA1 a24d39b29dc31600fa9b51567d7790c4c3e7a0e8
SHA512 62649c8b43fd96fd065a125b61258072c2aaecaccdea6ee572392c9d4071c75b4692b9973b2606e7afc46622ff89a3074302d8783beb556b17e5fdc7d2c23bd4
MD5 SHA1 SHA512

Score

10^/10

remcos more rat

Malware Config

Extracted

Family

remcos

Botnet

kashbilly.ddns.net:6060

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-T7O6K4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4068 set thread context of 3696	4068	ENQUIRY 20220509.exe	90

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3696	ENQUIRY 20220509.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90
PID 4068 wrote to memory of 3696	4068	ENQUIRY 20220509.exe	90

C:\Users\Admin\AppData\Local\Temp\ENQUIRY 20220509.exe
"C:\Users\Admin\AppData\Local\Temp\ENQUIRY 20220509.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\ENQUIRY 20220509.exe
  "C:\Users\Admin\AppData\Local\Temp\ENQUIRY 20220509.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3696-137-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3696-138-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3696-139-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/3696-140-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4068-130-0x0000000000CE0000-0x0000000000DA6000-memory.dmp

Download

memory/4068-131-0x0000000005CC0000-0x0000000006264000-memory.dmp

Download

memory/4068-132-0x00000000057B0000-0x0000000005842000-memory.dmp

Download

memory/4068-133-0x0000000005750000-0x000000000575A000-memory.dmp

Download

memory/4068-134-0x0000000009040000-0x00000000090DC000-memory.dmp

Download

memory/4068-135-0x0000000009640000-0x00000000096A6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads