remcos | 5ac95c5c69a4f7f26d0d6a53f1880e8dfbe4a3f91d7530aeb735f2cce8d5d607

General

Target

56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
Size

917KB
MD5

01a79d7d8926e913bce1218c60f65ef0
SHA1

23f333779045ebaf0e2982ce27e9c45518187df9
SHA256

56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2
SHA512

0c6c3706c704b1bcb9d2a8c5fa5c363c31d40ba854bf1b761b2585c4edb2b0aefddf51ecc720eb1b0b01d5e442d8647eba21856e49e2478533b4b9ffa98a96a2
SSDEEP

24576:WyOVQiM5+tLYjcggbvs5ApLcPKtqg0YJe1Y:WLQR+tLYotzFLcPpYJ4

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

51.75.209.245:2406

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52YOYG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe

description	pid	process	target process
PID 1416 set thread context of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

584 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe

description pid process

Token: SeDebugPrivilege 1416 56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe

pid process

1820 56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe

pid	process
584	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe

pid	process
1820	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe

C:\Users\Admin\AppData\Local\Temp\56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
"C:\Users\Admin\AppData\Local\Temp\56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XxWuTeaXQSo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC2D.tmp"
2⤵
- Creates scheduled task(s)
PID:584

C:\Users\Admin\AppData\Local\Temp\56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
40e6976f137cec71821ce377cd695c9e

SHA1
8476cef97bfb786c0083d2779bb16a7d09afd182

SHA256
cdc11908fdc8ddfb1ee45ff17cc0601a86ebff4bf061225950062be91b5f5d7c

SHA512
2cb3b5bc0cfc7b77f7b4fbf50a14a81e34143ca844527aba57cade8bf51e9368b50fd666cf67da2b3c65750b9e632ea0b16207ecfb2210948d1aa7c91305d70a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDC2D.tmp
Filesize
1KB

MD5
3586a0eaa3837838b2a1b489eef04c0f

SHA1
365a75d9be1dcdb7921e6e6832322c6234d5e5fe

SHA256
2b4b21775a72ec84ae9c4c048d7eb567d4719ce59b4269edb41a47ca6d6dea9b

SHA512
cb153803ad31d3bdb63aaf66028745c259d9a4d9ad071edd14f68223de7ac6ca95e0b8c5d5917992ea824c2d30d0582f384a0e9a0ad14ef7ecd8240c32a22370

Download Submit
memory/1416-54-0x00000000010D0000-0x00000000011BC000-memory.dmp

Filesize
944KB

Download
memory/1416-55-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/1416-56-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/1416-57-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/1416-58-0x0000000000940000-0x0000000000A02000-memory.dmp

Filesize
776KB

Download
memory/1416-59-0x0000000004CF0000-0x0000000004D6E000-memory.dmp

Filesize
504KB

Download
memory/1820-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-74-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-63-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-68-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-69-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1820-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-64-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-77-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-78-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-79-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-75-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-66-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-80-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-84-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-86-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-87-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-65-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-92-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-93-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-98-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-99-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-104-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1820-106-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

description	pid	process	target process
PID 1416 wrote to memory of 584	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	schtasks.exe
PID 1416 wrote to memory of 584	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	schtasks.exe
PID 1416 wrote to memory of 584	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	schtasks.exe
PID 1416 wrote to memory of 584	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	schtasks.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe
PID 1416 wrote to memory of 1820	1416	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe	56fc6644385db6a7e927858e276af6f8e6a33302f82bde48633975ba452954a2.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads