remcos | d4bee566c89c0e8c89f0539d2d49279f844317c54ee3216c049f038b773de8dc

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2022 20:20

Target

INQUIRY 3937489.exe
Size

1.1MB
MD5

637d6c0ed25f4c0cdb346448d337be6c
SHA1

fac78a61ed68ac9d0e1b107814bb56c2828da596
SHA256

d4bee566c89c0e8c89f0539d2d49279f844317c54ee3216c049f038b773de8dc
SHA512

4a10bd5dc2ff83b6294a417b4d457b544ff24c28c7c7034245fc6360d5e680ffd9947be70827dbb67cc786999c23ab5ce0e15dcd8a5e2fd83d539fb12449db43
SSDEEP

12288:Wv1HM7T0I9bgER7BDkw7oPVrL8YIIA0WvJnorEzXOYNJe9OYhUOtLA/0U9q465yp:OMf0ItxRlIPPVrL8sAzxOYOkObU9qmo

Score

10^/10

Family

remcos

Botnet

NEW REM STUB

valvesco.duckdns.org:5050

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

INQUIRY 3937489.exe

description pid process target process

PID 4972 set thread context of 2576 4972 INQUIRY 3937489.exe INQUIRY 3937489.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

INQUIRY 3937489.exe

pid process

4972 INQUIRY 3937489.exe
4972 INQUIRY 3937489.exe
4972 INQUIRY 3937489.exe
4972 INQUIRY 3937489.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

INQUIRY 3937489.exe

description pid process

Token: SeDebugPrivilege 4972 INQUIRY 3937489.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

INQUIRY 3937489.exe

pid process

2576 INQUIRY 3937489.exe

description	pid	process	target process
PID 4972 set thread context of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe

description	pid	process
Token: SeDebugPrivilege	4972	INQUIRY 3937489.exe

pid	process
2576	INQUIRY 3937489.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

INQUIRY 3937489.exe

description	pid	process	target process
PID 4972 wrote to memory of 2432	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2432	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2432	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe
PID 4972 wrote to memory of 2576	4972	INQUIRY 3937489.exe	INQUIRY 3937489.exe

C:\Users\Admin\AppData\Local\Temp\INQUIRY 3937489.exe
"C:\Users\Admin\AppData\Local\Temp\INQUIRY 3937489.exe"
2⤵
PID:2432

C:\Users\Admin\AppData\Local\Temp\INQUIRY 3937489.exe
"C:\Users\Admin\AppData\Local\Temp\INQUIRY 3937489.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2576

memory/2432-138-0x0000000000000000-mapping.dmp

Download
memory/2576-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2576-139-0x0000000000000000-mapping.dmp

Download
memory/2576-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2576-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2576-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2576-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4972-134-0x0000000005A40000-0x0000000005AD2000-memory.dmp

Filesize
584KB

Download
memory/4972-135-0x0000000005AF0000-0x0000000005AFA000-memory.dmp

Filesize
40KB

Download
memory/4972-136-0x00000000085C0000-0x000000000865C000-memory.dmp

Filesize
624KB

Download
memory/4972-137-0x00000000088D0000-0x0000000008936000-memory.dmp

Filesize
408KB

Download
memory/4972-133-0x0000000006110000-0x00000000066B4000-memory.dmp

Filesize
5.6MB

Download
memory/4972-132-0x0000000000F90000-0x00000000010A2000-memory.dmp

Filesize
1.1MB

Download