remcos | 69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3

General

Target

69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
Size

1.2MB
MD5

164e1922217e4b26d35caaee316b53e5
SHA1

932af0a69937a982f3f5481ed93e7ae1818fdd5d
SHA256

69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3
SHA512

1949be73a88eb79fe08878fcef61608891283df7f8f4165fbbe6560995751ddf42b35e022961963986efa96218efe8e441dc3ff9062b128575858450f9ed91e4
SSDEEP

24576:QW4vegkwcBshm7KSzK6HeYKroelMpSKRvrt+Y7D4Cc:QW4MshmumSrov8ErND2

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

ban318937.sytes.net:1492

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-XEYQLH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe

description	pid	process	target process
PID 3720 set thread context of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe

pid process

3304 69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe

pid	process
3304	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe

description	pid	process	target process
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
PID 3720 wrote to memory of 3304	3720	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe	69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe

C:\Users\Admin\AppData\Local\Temp\69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
"C:\Users\Admin\AppData\Local\Temp\69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3720

C:\Users\Admin\AppData\Local\Temp\69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe
"C:\Users\Admin\AppData\Local\Temp\69372bffe2fde76d9ff14e2c60dd8ec83575a6da07ea03ccc5cfa35aeb78afc3.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3304-138-0x0000000000000000-mapping.dmp

Download
memory/3304-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3304-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3304-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3304-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3304-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3720-132-0x00000000006C0000-0x00000000007F4000-memory.dmp

Filesize
1.2MB

Download
memory/3720-133-0x0000000005630000-0x0000000005BD4000-memory.dmp

Filesize
5.6MB

Download
memory/3720-134-0x0000000005080000-0x0000000005112000-memory.dmp

Filesize
584KB

Download
memory/3720-135-0x0000000005050000-0x000000000505A000-memory.dmp

Filesize
40KB

Download
memory/3720-136-0x0000000008C20000-0x0000000008CBC000-memory.dmp

Filesize
624KB

Download
memory/3720-137-0x0000000008D30000-0x0000000008D96000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing