remcos | 440cf58dc6b8e4724c669e148969ecd8d424c9bf6dbdec6e358fdca7e72b3734

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2022, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
def50d5f98cc503ee83da2e12f2a123d.exe
Size 1.2MB
Sample221007-m99kmscdfn
SHA256 440cf58dc6b8e4724c669e148969ecd8d424c9bf6dbdec6e358fdca7e72b3734
MD5 def50d5f98cc503ee83da2e12f2a123d
SHA1 24cb98a1cf5f86cbf771110777b10f77042d4942
SHA512 7bacedb996fc287b842fa277e29b9a162bf9d28acc1d71f689a90a816638e895a7876c53844a35a654ad4d7bf03e8015750eace15cc05d5d6ed7e6711fa73512
SSDEEP 24576:q1xPytaVktTqNzQxLuYjo9+2zAx+dKpdM5:q/CT6wLJj2A0kdM5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

ban318937.sytes.net:1492

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-XEYQLH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3368 set thread context of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3368	def50d5f98cc503ee83da2e12f2a123d.exe
3368	def50d5f98cc503ee83da2e12f2a123d.exe
3368	def50d5f98cc503ee83da2e12f2a123d.exe
3368	def50d5f98cc503ee83da2e12f2a123d.exe
3368	def50d5f98cc503ee83da2e12f2a123d.exe
3368	def50d5f98cc503ee83da2e12f2a123d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	def50d5f98cc503ee83da2e12f2a123d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1772	def50d5f98cc503ee83da2e12f2a123d.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2344	3368	def50d5f98cc503ee83da2e12f2a123d.exe	90
PID 3368 wrote to memory of 2344	3368	def50d5f98cc503ee83da2e12f2a123d.exe	90
PID 3368 wrote to memory of 2344	3368	def50d5f98cc503ee83da2e12f2a123d.exe	90
PID 3368 wrote to memory of 1148	3368	def50d5f98cc503ee83da2e12f2a123d.exe	91
PID 3368 wrote to memory of 1148	3368	def50d5f98cc503ee83da2e12f2a123d.exe	91
PID 3368 wrote to memory of 1148	3368	def50d5f98cc503ee83da2e12f2a123d.exe	91
PID 3368 wrote to memory of 1824	3368	def50d5f98cc503ee83da2e12f2a123d.exe	92
PID 3368 wrote to memory of 1824	3368	def50d5f98cc503ee83da2e12f2a123d.exe	92
PID 3368 wrote to memory of 1824	3368	def50d5f98cc503ee83da2e12f2a123d.exe	92
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93
PID 3368 wrote to memory of 1772	3368	def50d5f98cc503ee83da2e12f2a123d.exe	93

C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe
"C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe
  "C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe"
  2⤵
  PID:2344
- C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe
  "C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe"
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe
  "C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe"
  2⤵
  PID:1824
- C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe
  "C:\Users\Admin\AppData\Local\Temp\def50d5f98cc503ee83da2e12f2a123d.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-146-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1772-145-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1772-144-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1772-143-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1772-142-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3368-132-0x0000000000FD0000-0x0000000001108000-memory.dmp

Download

memory/3368-137-0x000000000ABB0000-0x000000000AC16000-memory.dmp

Download

memory/3368-136-0x000000000AB10000-0x000000000ABAC000-memory.dmp

Download

memory/3368-135-0x0000000005AB0000-0x0000000005ABA000-memory.dmp

Download

memory/3368-134-0x0000000005AD0000-0x0000000005B62000-memory.dmp

Download

memory/3368-133-0x0000000005FE0000-0x0000000006584000-memory.dmp

Download