remcos | b6ebe092221b9cb70949480fbc97133fa1e408c657150bb50c41171321b2fb73

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2022 08:04

Target

ITEM DATA SHEET.exe
Size

1.2MB
MD5

c95b522710130a7d48a91a7adf58fbb4
SHA1

c8177c93f5a01434516f43bfb34b49c82b8a4a00
SHA256

b6ebe092221b9cb70949480fbc97133fa1e408c657150bb50c41171321b2fb73
SHA512

d7ac349ae55357c73db01780bec16712fe58dea44a75e792d99dd22766b06a5cbb0272c9a3752b3fb0de7c2354beb64e51bf241d2370749a1d48cff61a0f06ac
SSDEEP

12288:cx1goP2MRzbeykkXoposLC6/M698kgMhMk6jwv+rB/4vVWwPN:co85edLv/M698U6jI+rx4vVXP

Score

10^/10

Family

remcos

Botnet

NEW REM STUB

valvesco.duckdns.org:5050

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

ITEM DATA SHEET.exe

description pid process target process

PID 448 set thread context of 4524 448 ITEM DATA SHEET.exe ITEM DATA SHEET.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ITEM DATA SHEET.exe

pid process

448 ITEM DATA SHEET.exe
448 ITEM DATA SHEET.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ITEM DATA SHEET.exe

description pid process

Token: SeDebugPrivilege 448 ITEM DATA SHEET.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ITEM DATA SHEET.exe

pid process

4524 ITEM DATA SHEET.exe

description	pid	process	target process
PID 448 set thread context of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe

pid	process
448	ITEM DATA SHEET.exe
448	ITEM DATA SHEET.exe

description	pid	process
Token: SeDebugPrivilege	448	ITEM DATA SHEET.exe

pid	process
4524	ITEM DATA SHEET.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ITEM DATA SHEET.exe

description	pid	process	target process
PID 448 wrote to memory of 2268	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 2268	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 2268	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe
PID 448 wrote to memory of 4524	448	ITEM DATA SHEET.exe	ITEM DATA SHEET.exe

C:\Users\Admin\AppData\Local\Temp\ITEM DATA SHEET.exe
"C:\Users\Admin\AppData\Local\Temp\ITEM DATA SHEET.exe"
2⤵
PID:2268

C:\Users\Admin\AppData\Local\Temp\ITEM DATA SHEET.exe
"C:\Users\Admin\AppData\Local\Temp\ITEM DATA SHEET.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4524

memory/448-132-0x00000000006F0000-0x0000000000822000-memory.dmp

Filesize
1.2MB

Download
memory/448-133-0x0000000005800000-0x0000000005DA4000-memory.dmp

Filesize
5.6MB

Download
memory/448-134-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/448-135-0x00000000051D0000-0x00000000051DA000-memory.dmp

Filesize
40KB

Download
memory/448-136-0x0000000007A00000-0x0000000007A9C000-memory.dmp

Filesize
624KB

Download
memory/448-137-0x0000000007BA0000-0x0000000007C06000-memory.dmp

Filesize
408KB

Download
memory/2268-138-0x0000000000000000-mapping.dmp

Download
memory/4524-139-0x0000000000000000-mapping.dmp

Download
memory/4524-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4524-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4524-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4524-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4524-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download