remcos | 282760aaaa1b23718548e3a4bac27b594de3c83f3db15a453cf3d123a8bfc7e9 | Triage

Analysis

max time kernel
168s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-05-2022 22:40

Sharing

Report Analysis Logs

General

Target

vbc.exe
Size

464KB
MD5

ebf5113c6c5ae6b441dd21df3f87a396
SHA1

30c6a54d6f58b5d1ce4cfcb6f7d820e2f909e10c
SHA256

282760aaaa1b23718548e3a4bac27b594de3c83f3db15a453cf3d123a8bfc7e9
SHA512

0f5cfccd6a5a7eaa49aad91d8ab8eca8eb8f2b88d7f42e60b8fedeb110d832c4e0a610a93b3c0d710e2e72930408135862bd97669876b0713066c223e3f3bcbf

Score

10^/10

remcos rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

5112 vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...