remcos | 4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10/02/2023, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe
Size 584KB
Sample230210-e1gt9seh79
SHA256 4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728
MD5 75840641905d0a05db8632c82f0f65e9
SHA1 781ba96edda22e37fd5a36ded0f3d7c3cc12a92f
SHA512 04b2e3e8fc548dc46a73392ad1145f9730a27e97a8a4b2a241e9989c60c5b46f9d32b65b62aa9c141f39ea6673d875c7c4b89e752e13279cfe24c20ad1a7e764
SSDEEP 12288:jNYhnGptebn2cX2aZxc5pxMP0W8tsHkXi7oQqykP/Ci/F:BYJ2obn262N5py05tsHkXhQs/N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

top.thekillforabuse1.xyz:55988

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-5MR2PR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sysjsjsjtem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sysjsjsjtem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe
4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe
728	Powershell.exe
728	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe
Token: SeDebugPrivilege	728	Powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 728	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	85
PID 4352 wrote to memory of 728	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	85
PID 4352 wrote to memory of 728	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	85
PID 4352 wrote to memory of 368	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	87
PID 4352 wrote to memory of 368	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	87
PID 4352 wrote to memory of 368	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	87
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88
PID 4352 wrote to memory of 2548	4352	4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe	88

C:\Users\Admin\AppData\Local\Temp\4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe
"C:\Users\Admin\AppData\Local\Temp\4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\4d79b33e220433112cc2b309be56a1fa511d59c376b19df936c5debbd14d4728.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sysjsjsjtem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/728-142-0x00000000051D0000-0x00000000057F8000-memory.dmp

Download

memory/728-146-0x0000000005900000-0x0000000005966000-memory.dmp

Download

memory/728-151-0x0000000006530000-0x0000000006552000-memory.dmp

Download

memory/728-150-0x00000000064D0000-0x00000000064EA000-memory.dmp

Download

memory/728-149-0x00000000065D0000-0x0000000006666000-memory.dmp

Download

memory/728-147-0x0000000006080000-0x000000000609E000-memory.dmp

Download

memory/728-145-0x0000000005150000-0x00000000051B6000-memory.dmp

Download

memory/728-136-0x0000000000DC0000-0x0000000000DF6000-memory.dmp

Download

memory/728-143-0x0000000004EB0000-0x0000000004ED2000-memory.dmp

Download

memory/2548-144-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2548-140-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2548-141-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2548-139-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2548-148-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4352-134-0x0000000005910000-0x00000000059AC000-memory.dmp

Download

memory/4352-133-0x0000000005E20000-0x00000000063C4000-memory.dmp

Download

memory/4352-132-0x0000000000BF0000-0x0000000000C88000-memory.dmp

Download