remcos | 4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2023, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 584KB
Sample230113-q6d64sda7y
SHA256 4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728
MD5 75840641905d0a05db8632c82f0f65e9
SHA1 781ba96edda22e37fd5a36ded0f3d7c3cc12a92f
SHA512 04b2e3e8fc548dc46a73392ad1145f9730a27e97a8a4b2a241e9989c60c5b46f9d32b65b62aa9c141f39ea6673d875c7c4b89e752e13279cfe24c20ad1a7e764
SSDEEP 12288:jNYhnGptebn2cX2aZxc5pxMP0W8tsHkXi7oQqykP/Ci/F:BYJ2obn262N5py05tsHkXhQs/N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

top.thekillforabuse1.xyz:55988

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-5MR2PR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sysjsjsjtem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sysjsjsjtem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3248 set thread context of 3708	3248	file.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1580	Powershell.exe
1580	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	file.exe
Token: SeDebugPrivilege	1580	Powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1580	3248	file.exe	90
PID 3248 wrote to memory of 1580	3248	file.exe	90
PID 3248 wrote to memory of 1580	3248	file.exe	90
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92
PID 3248 wrote to memory of 3708	3248	file.exe	92

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\file.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sysjsjsjtem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-140-0x0000000005500000-0x0000000005B28000-memory.dmp

Download

memory/1580-146-0x0000000006330000-0x000000000634E000-memory.dmp

Download

memory/1580-149-0x0000000006820000-0x0000000006842000-memory.dmp

Download

memory/1580-136-0x0000000004D70000-0x0000000004DA6000-memory.dmp

Download

memory/1580-148-0x00000000067B0000-0x00000000067CA000-memory.dmp

Download

memory/1580-147-0x00000000072F0000-0x0000000007386000-memory.dmp

Download

memory/1580-142-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/1580-143-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Download

memory/1580-144-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Download

memory/3248-134-0x00000000050F0000-0x000000000518C000-memory.dmp

Download

memory/3248-132-0x0000000000690000-0x0000000000728000-memory.dmp

Download

memory/3248-133-0x0000000005780000-0x0000000005D24000-memory.dmp

Download

memory/3708-145-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3708-139-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3708-138-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3708-141-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3708-150-0x0000000000400000-0x000000000047F000-memory.dmp

Download