remcos | 6552dfa10dbb750d8fa36d567663298ea8f0b1f21668dc0ccd5b51afd82c2de3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2022, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40e3951cf236df005884b7027e7eccdc.exe
Size 132KB
Sample220823-n6b1msecgm
SHA256 6552dfa10dbb750d8fa36d567663298ea8f0b1f21668dc0ccd5b51afd82c2de3
MD5 40e3951cf236df005884b7027e7eccdc
SHA1 3f852466328e3d36f88320f6d0ca437bc64e0bdd
SHA512 4a3d53d5e06192c16db27e233f2e98e771a193b1dcbb7f05f0a44fb06fd9efc19e82463ddb1fe599c1f8895c099633ea5d8ebb23d4c17fe64b4e0a2a09eafee1
MD5 SHA1 SHA512

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

2.2.0 Light

Botnet

RemoteHost

192.168.1.4:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-48LR8P
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	40e3951cf236df005884b7027e7eccdc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1776	40e3951cf236df005884b7027e7eccdc.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1776	40e3951cf236df005884b7027e7eccdc.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85
PID 2172 wrote to memory of 1776	2172	40e3951cf236df005884b7027e7eccdc.exe	85

C:\Users\Admin\AppData\Local\Temp\40e3951cf236df005884b7027e7eccdc.exe
"C:\Users\Admin\AppData\Local\Temp\40e3951cf236df005884b7027e7eccdc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\40e3951cf236df005884b7027e7eccdc.exe
  "C:\Users\Admin\AppData\Local\Temp\40e3951cf236df005884b7027e7eccdc.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-138-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1776-140-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1776-141-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2172-132-0x0000000000A50000-0x0000000000A78000-memory.dmp

Download

memory/2172-133-0x0000000005A60000-0x0000000006004000-memory.dmp

Download

memory/2172-134-0x00000000054B0000-0x0000000005542000-memory.dmp

Download

memory/2172-135-0x0000000005420000-0x000000000542A000-memory.dmp

Download

memory/2172-136-0x0000000006040000-0x00000000060DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads