remcos | 6534823922c1889047e2edc0aab14482758d7dbdd296941403ae7657cb248e05

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2023, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IRD-N.º 8800.exe
Size 1.9MB
Sample230211-lnrx2add91
SHA256 6534823922c1889047e2edc0aab14482758d7dbdd296941403ae7657cb248e05
MD5 f143d5d6ba24c430f0103c91ceb294dd
SHA1 a2f2299c0a36a654def4aa1f4d9a129c378cd3fe
SHA512 36b34fc8a56646f184ac738025fd5844a4dd5a5b53726e0e0c257c058230d63ef1e1c56dd95fe0e41902fb339d4c97e9ac6678d8c9256c10baabbe4b1e6e68cc
SSDEEP 24576:YjyF7b9VCruYAkF/sHd/wuC7zMGavgVOWp9OPTfCzd:8UBwrE9/xxGm2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

161.129.44.36:5888

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-5LO7XW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1604 set thread context of 452	1604	IRD-N.º 8800.exe	86

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1604	IRD-N.º 8800.exe
1604	IRD-N.º 8800.exe
1604	IRD-N.º 8800.exe
1604	IRD-N.º 8800.exe
1604	IRD-N.º 8800.exe
1604	IRD-N.º 8800.exe
1604	IRD-N.º 8800.exe
1604	IRD-N.º 8800.exe
1604	IRD-N.º 8800.exe
1604	IRD-N.º 8800.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	IRD-N.º 8800.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 3208	1604	IRD-N.º 8800.exe	81
PID 1604 wrote to memory of 3208	1604	IRD-N.º 8800.exe	81
PID 1604 wrote to memory of 2324	1604	IRD-N.º 8800.exe	82
PID 1604 wrote to memory of 2324	1604	IRD-N.º 8800.exe	82
PID 1604 wrote to memory of 1752	1604	IRD-N.º 8800.exe	83
PID 1604 wrote to memory of 1752	1604	IRD-N.º 8800.exe	83
PID 1604 wrote to memory of 2020	1604	IRD-N.º 8800.exe	84
PID 1604 wrote to memory of 2020	1604	IRD-N.º 8800.exe	84
PID 1604 wrote to memory of 4236	1604	IRD-N.º 8800.exe	85
PID 1604 wrote to memory of 4236	1604	IRD-N.º 8800.exe	85
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86
PID 1604 wrote to memory of 452	1604	IRD-N.º 8800.exe	86

C:\Users\Admin\AppData\Local\Temp\IRD-N.º 8800.exe
"C:\Users\Admin\AppData\Local\Temp\IRD-N.º 8800.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:3208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:4236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-134-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/452-137-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/452-138-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/452-139-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/452-140-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1604-132-0x000001ED546B0000-0x000001ED548A6000-memory.dmp

Download

memory/1604-133-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/1604-136-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download