remcos | f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225

Analysis

max time kernel
148s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2023, 14:43

Target

pre alert notice.exe
Size

64KB
MD5

8595f4d3b0f77f0b34b575fd4e8d89e3
SHA1

0f14cc20a764a431c9522585037170e55dfe0d64
SHA256

f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225
SHA512

d5666b6053405884a4ee8ea886d8c1e8620df39e1fdf3a5e789fd7882bab94bc96f5d696c8be8452de39186b974c7435b553ee736f35f59ab622a1cffabad488
SSDEEP

768:M0OGy94wjvuLm0DNOD9I840O/KeSHs40LO6dusn04eZ:JOd94wjvuL9a9I84us40ymuL3Z

Score

10^/10

Family

remcos

Botnet

RemoteHost

45.87.61.104:3033

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5016 set thread context of 1628	5016	pre alert notice.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	pre alert notice.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 2164	5016	pre alert notice.exe	80
PID 5016 wrote to memory of 2164	5016	pre alert notice.exe	80
PID 5016 wrote to memory of 1276	5016	pre alert notice.exe	81
PID 5016 wrote to memory of 1276	5016	pre alert notice.exe	81
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82
PID 5016 wrote to memory of 1628	5016	pre alert notice.exe	82

C:\Users\Admin\AppData\Local\Temp\pre alert notice.exe
"C:\Users\Admin\AppData\Local\Temp\pre alert notice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
  2⤵
  PID:2164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
  2⤵
  PID:1276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:1628

memory/1628-134-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1628-137-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1628-138-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1628-139-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1628-140-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/5016-132-0x0000026A803B0000-0x0000026A803C4000-memory.dmp

Filesize
80KB

Download
memory/5016-133-0x00007FFAFA6A0000-0x00007FFAFB161000-memory.dmp

Filesize
10.8MB

Download
memory/5016-136-0x00007FFAFA6A0000-0x00007FFAFB161000-memory.dmp

Filesize
10.8MB

Download