remcos | 2fd70cf5a6097502fb9123e63b6674666134a56927943bc8b7d79dc00bb7c02d

Analysis

max time kernel
189s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 09:50

Target

BUSINESS ENQUIRY 005.exe
Size

1.1MB
MD5

6ef93d48ec65e15d952f0c8da96112e0
SHA1

969da5f9dbf9f63d10fd36f04dda4586854d3281
SHA256

2fd70cf5a6097502fb9123e63b6674666134a56927943bc8b7d79dc00bb7c02d
SHA512

9afc74a84fec9cca00d5267aa7f09416dd3d336cf30e82169021a5985197d07c87313c3655a60df739dd0fa597eb547881356428001cca08a71ea774d99ae175
SSDEEP

24576:59m1U+dgyO88LW4EMZU9+mGm66UPBlwk7gBvi:59mHdgyoLW4dZUUmFM5UBv

Score

10^/10

Family

remcos

Botnet

NEW REM STUB

valvesco.duckdns.org:5050

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

BUSINESS ENQUIRY 005.exe

description pid process target process

PID 4748 set thread context of 2128 4748 BUSINESS ENQUIRY 005.exe BUSINESS ENQUIRY 005.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

BUSINESS ENQUIRY 005.exe

pid process

4748 BUSINESS ENQUIRY 005.exe
4748 BUSINESS ENQUIRY 005.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

BUSINESS ENQUIRY 005.exe

description pid process

Token: SeDebugPrivilege 4748 BUSINESS ENQUIRY 005.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BUSINESS ENQUIRY 005.exe

pid process

2128 BUSINESS ENQUIRY 005.exe

description	pid	process	target process
PID 4748 set thread context of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe

pid	process
4748	BUSINESS ENQUIRY 005.exe
4748	BUSINESS ENQUIRY 005.exe

description	pid	process
Token: SeDebugPrivilege	4748	BUSINESS ENQUIRY 005.exe

pid	process
2128	BUSINESS ENQUIRY 005.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

BUSINESS ENQUIRY 005.exe

description	pid	process	target process
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe
PID 4748 wrote to memory of 2128	4748	BUSINESS ENQUIRY 005.exe	BUSINESS ENQUIRY 005.exe

C:\Users\Admin\AppData\Local\Temp\BUSINESS ENQUIRY 005.exe
"C:\Users\Admin\AppData\Local\Temp\BUSINESS ENQUIRY 005.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2128

memory/2128-138-0x0000000000000000-mapping.dmp

Download
memory/2128-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2128-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2128-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2128-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2128-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4748-132-0x0000000000AD0000-0x0000000000BE4000-memory.dmp

Filesize
1.1MB

Download
memory/4748-133-0x0000000005B20000-0x00000000060C4000-memory.dmp

Filesize
5.6MB

Download
memory/4748-134-0x0000000005570000-0x0000000005602000-memory.dmp

Filesize
584KB

Download
memory/4748-135-0x0000000005610000-0x000000000561A000-memory.dmp

Filesize
40KB

Download
memory/4748-136-0x00000000082F0000-0x000000000838C000-memory.dmp

Filesize
624KB

Download
memory/4748-137-0x0000000008630000-0x0000000008696000-memory.dmp

Filesize
408KB

Download