remcos | 1a8b52c2050338f393e41d4dfa89c2e14783133dc2b820365fc8099d1da021a7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2023, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp.exe
Size 511KB
Sample230216-l9ws4sha76
SHA256 1a8b52c2050338f393e41d4dfa89c2e14783133dc2b820365fc8099d1da021a7
MD5 82bd8714592fdf7122cd90b1d40fd91e
SHA1 2dd34828be4150a837ce190dccc0700069062e19
SHA512 7166636d4dcd247895a9302d8a59e2919da37393d8df8353d43a54a40d28b3b78b2e57d22bd8ba5c1d9bcd4d54da343aef4477d54775c249ab063f954922b947
SSDEEP 12288:BcCulu3AZhxyWQ5iLOjx4EaRreFJZt2g2ZitW0D:OPNYWUyex49pQRt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat upx

Malware Config

Extracted

Family

remcos

Version

4.3.0 Light

Botnet

RemoteHost

80.66.75.51:12565
80.66.75.51:63464
80.66.75.51:1352

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-1V757H
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/820-135-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/820-136-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/820-137-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/820-139-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/820-140-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/820-141-0x0000000000400000-0x000000000047C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 820	4884	tmp.exe	83

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 820	4884	tmp.exe	83
PID 4884 wrote to memory of 820	4884	tmp.exe	83
PID 4884 wrote to memory of 820	4884	tmp.exe	83
PID 4884 wrote to memory of 820	4884	tmp.exe	83
PID 4884 wrote to memory of 820	4884	tmp.exe	83
PID 4884 wrote to memory of 820	4884	tmp.exe	83
PID 4884 wrote to memory of 820	4884	tmp.exe	83

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-135-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/820-136-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/820-137-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/820-139-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/820-140-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/820-141-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/4884-132-0x0000000000240000-0x00000000002C6000-memory.dmp

Download

memory/4884-133-0x0000000004CE0000-0x0000000004D02000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads