remcos | 0f5a9777480bfe11af4c7977505709f7ceb87d30f886887ca5f483533912cf68

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2023, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA.exe
Size 532KB
Sample230208-rp93wsbf35
SHA256 0f5a9777480bfe11af4c7977505709f7ceb87d30f886887ca5f483533912cf68
MD5 35a393ae8fc738a476259ef1893d8119
SHA1 1af166ae6750f9bb7adb568b91489b40bbe100cd
SHA512 d4265adccd98f1d91bc0f3f2a1a047cdcc06b5dde95e490e80b05c28c1efad23edd5e4817b61061d051fb53fe86ca7fa4e29b104c25d05187abe1ca117a271a8
SSDEEP 12288:/Y564jBPCi81JDLdm6OkKzYqGW4tnVERE/Y2X/FUL5gfM:/Y5BYiKLd5OtbG/tnt/Y2eR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

45.87.61.104:3033

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QWPMSY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
396	qglcuki.exe
1844	qglcuki.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 396 set thread context of 1844	396	qglcuki.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
396	qglcuki.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 396	2280	SOA.exe	79
PID 2280 wrote to memory of 396	2280	SOA.exe	79
PID 2280 wrote to memory of 396	2280	SOA.exe	79
PID 396 wrote to memory of 1844	396	qglcuki.exe	80
PID 396 wrote to memory of 1844	396	qglcuki.exe	80
PID 396 wrote to memory of 1844	396	qglcuki.exe	80
PID 396 wrote to memory of 1844	396	qglcuki.exe	80

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\qglcuki.exe
  "C:\Users\Admin\AppData\Local\Temp\qglcuki.exe" C:\Users\Admin\AppData\Local\Temp\kjceldlbwih.mo
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Users\Admin\AppData\Local\Temp\qglcuki.exe
    "C:\Users\Admin\AppData\Local\Temp\qglcuki.exe"
    3⤵
    - Executes dropped EXE
    PID:1844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

akzjcnvi.z

Path C:\Users\Admin\AppData\Local\Temp\akzjcnvi.z
Size 495KB
SHA256 60181298381e80222bbfb8fcec0bc1b6c52632ad87b5632557361e614a532fc3
MD5 47dd51fc0bbb24ca6abbd2e17041869b
SHA1 7a0fb5e12d94ef5b91da1b431a3d987aa62cc22f
SHA512 b5ddca9d03ded2b521008f17f71c4805ddcfc4938d53479b87835e8f9ee0a497bc52a4ab354b39d5963a09d2fc43b169aa57e0fa2b4ef447e4eb7a9d4e4757f0
SSDEEP 12288:gGWN/8UO+Vk3xw91PvVJbhHySClLJatilNi0JcUYH5JXIzzZz9JQMGKKK7eUARQ9:gBNUF+Vk3xmFvzNySCdJat4i+cUY5JXM
MD5 SHA1 SHA512 SSDEEP

Submit Download

kjceldlbwih.mo

Path C:\Users\Admin\AppData\Local\Temp\kjceldlbwih.mo
Size 5KB
SHA256 d945b4aed4c6c42b4cba771fee1f577a7b221b7f759533be070eb97d82da6ef7
MD5 5e54a51f2bfa1962149b231991d4d41c
SHA1 25ee59132b059145667b91d8e1b1b9dc1ee204eb
SHA512 6dd5e3432d02238292bc3fe096ed662a5e0f78a4829fa6a19d5973393b326c87e5ed6e74e7853691c549f56eec778f36c0dcedc4db985d26a9967a574739164b
SSDEEP 96:Farc6oYsg/DrYusk2XO5oSwYm1VBph3OkMWidK7K4nmALqMEdxaxXIf/3AVWmPX:FarcRQ0hX1S9I//OkMW+K7K6+FdTvNmP
MD5 SHA1 SHA512 SSDEEP

Submit Download

qglcuki.exe

Path C:\Users\Admin\AppData\Local\Temp\qglcuki.exe
Size 131KB
SHA256 e2385cc2e24597afacc3677bc28743e9ca0201da93821ae8166adf5e9852da3d
MD5 df0343e2beb0fa598ec051e2f3f6c3f0
SHA1 3775dce7a7ef1737d17df27defb35fc6532be258
SHA512 f8f72521cadca3371c9a13b75c1e177583bc6283d27f7b17179cd3866ff3898a0b19e63f6480f5a1899119cfd606d80bfb84fcbfafa4825ef06f567687b3aede
SSDEEP 3072:w8/VApZl5zAahB52drrgaduBv85MTVd2sakX:w8szAu72drrgN3TP
MD5 SHA1 SHA512 SSDEEP

Submit Download

qglcuki.exe

Path C:\Users\Admin\AppData\Local\Temp\qglcuki.exe
Size 131KB
SHA256 e2385cc2e24597afacc3677bc28743e9ca0201da93821ae8166adf5e9852da3d
MD5 df0343e2beb0fa598ec051e2f3f6c3f0
SHA1 3775dce7a7ef1737d17df27defb35fc6532be258
SHA512 f8f72521cadca3371c9a13b75c1e177583bc6283d27f7b17179cd3866ff3898a0b19e63f6480f5a1899119cfd606d80bfb84fcbfafa4825ef06f567687b3aede
SSDEEP 3072:w8/VApZl5zAahB52drrgaduBv85MTVd2sakX:w8szAu72drrgN3TP
MD5 SHA1 SHA512 SSDEEP

Submit Download

qglcuki.exe

Path C:\Users\Admin\AppData\Local\Temp\qglcuki.exe
Size 131KB
SHA256 e2385cc2e24597afacc3677bc28743e9ca0201da93821ae8166adf5e9852da3d
MD5 df0343e2beb0fa598ec051e2f3f6c3f0
SHA1 3775dce7a7ef1737d17df27defb35fc6532be258
SHA512 f8f72521cadca3371c9a13b75c1e177583bc6283d27f7b17179cd3866ff3898a0b19e63f6480f5a1899119cfd606d80bfb84fcbfafa4825ef06f567687b3aede
SSDEEP 3072:w8/VApZl5zAahB52drrgaduBv85MTVd2sakX:w8szAu72drrgN3TP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1844-139-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1844-140-0x0000000000400000-0x0000000000480000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads