remcos | a3d2a0011ed5bddfd9ab11fed76afbd5d56d5a4ead896110944eea0f1a30c7de

General

Target

4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
Size

936KB
MD5

c44491911d5cfcc1dc31ac019c2714aa
SHA1

635e1be851baee85fb17cb2781bc6d9ee6a94f8b
SHA256

4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049
SHA512

e4649b1878060833939f6762df5a95275f4b5c4b7108eab2100140a2a5fbd39374d8f9e177a9182423c74d246808e68228f6dd6b6cf109894a255f8ce4505c15
SSDEEP

12288:/44mF6XP6Cau9Jez6Qf2ItKcTvNwjc5ul/1hfeq85A1DisBCos5yrO6okfY+uEjQ:/Ba6fsWlawcWrZYoZfBBj

Score

10^/10

remcos xp rat

Malware Config

Extracted

Family

remcos

Botnet

XP

C2

xpremcuz300622.ddns.net:3542

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
oos.exe
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Remcos-MMP2I7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
kkl
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe

description	pid	process	target process
PID 1380 set thread context of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe

description	pid	process	target process
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
PID 1380 wrote to memory of 332	1380	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe	4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe

C:\Users\Admin\AppData\Local\Temp\4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
"C:\Users\Admin\AppData\Local\Temp\4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe
"C:\Users\Admin\AppData\Local\Temp\4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049.exe"
2⤵
PID:332

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-68-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/332-60-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/332-73-0x000000000043168C-mapping.dmp

Download
memory/332-72-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/332-65-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/332-70-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/332-67-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/332-61-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/332-66-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/332-63-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1380-58-0x0000000007CC0000-0x0000000007D72000-memory.dmp

Filesize
712KB

Download
memory/1380-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1380-54-0x0000000000180000-0x0000000000270000-memory.dmp

Filesize
960KB

Download
memory/1380-59-0x0000000005B60000-0x0000000005BDA000-memory.dmp

Filesize
488KB

Download
memory/1380-57-0x00000000045C0000-0x00000000045D6000-memory.dmp

Filesize
88KB

Download
memory/1380-56-0x0000000004F60000-0x0000000005044000-memory.dmp

Filesize
912KB

Download

Analysis

Sharing