remcos | 440cf58dc6b8e4724c669e148969ecd8d424c9bf6dbdec6e358fdca7e72b3734

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
def50d5f98cc503ee83da2e12f2a123d.exe
Size 1.2MB
Sample221007-m99kmscdfn
SHA256 440cf58dc6b8e4724c669e148969ecd8d424c9bf6dbdec6e358fdca7e72b3734
MD5 def50d5f98cc503ee83da2e12f2a123d
SHA1 24cb98a1cf5f86cbf771110777b10f77042d4942
SHA512 7bacedb996fc287b842fa277e29b9a162bf9d28acc1d71f689a90a816638e895a7876c53844a35a654ad4d7bf03e8015750eace15cc05d5d6ed7e6711fa73512
SSDEEP 24576:q1xPytaVktTqNzQxLuYjo9+2zAx+dKpdM5:q/CT6wLJj2A0kdM5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

ban318937.sytes.net:1492

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-XEYQLH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1752 set thread context of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1516	def50d5f98cc503ee83da2e12f2a123d.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28
PID 1752 wrote to memory of 1516	1752	def50d5f98cc503ee83da2e12f2a123d.exe	28

C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe
"C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe
  "C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-68-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-70-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-78-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-65-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-77-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-76-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-60-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-61-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-66-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-72-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-67-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1516-63-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1752-54-0x0000000001040000-0x0000000001178000-memory.dmp

Download

memory/1752-57-0x00000000003D0000-0x00000000003DC000-memory.dmp

Download

memory/1752-55-0x0000000076261000-0x0000000076263000-memory.dmp

Download

memory/1752-59-0x0000000005D90000-0x0000000005E10000-memory.dmp

Download

memory/1752-58-0x0000000005AB0000-0x0000000005B84000-memory.dmp

Download

memory/1752-56-0x00000000003B0000-0x00000000003C8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads