remcos | 05a5e41d72b42e2ab08a2b9afce8780ba729f20128a86b83e649df6292a4e7b0

General

Target

TNT Original Invoice.exe
Size

3.0MB
MD5

c8c0264dca37efd9416dd2ec9dd5c931
SHA1

d99726a37eecb89ac7c0e8011617c952ad870762
SHA256

05a5e41d72b42e2ab08a2b9afce8780ba729f20128a86b83e649df6292a4e7b0
SHA512

7fc8bf021d0dd3a9e4997641340de811da87dc6d594e7e082b2a543dfa3fd3563e625797bb9648dcdef1e3830c2d10a9d51a3ac9d7310f930219c3a8fbbd6f52
SSDEEP

24576:7DX7TWfq0acNRVAWEo6E+uSLgaHgDZXhETZjipt/flxGV7hya0eqrmBtngpyyedk:HdNH2XSTZiAVnYD1JzOR1cUabuwHH

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

51.75.209.245:2406

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52YOYG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 1732	1964	TNT Original Invoice.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1732	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27
PID 1964 wrote to memory of 1732	1964	TNT Original Invoice.exe	27

C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
6717400cac21ea0c512858500505b17c

SHA1
76f763b81f7e3a645211dc843d9ccf7ae2976376

SHA256
46b4044659b0010fab34fa3bf6e6f42fd66025886c27b46c6ffbea30cf7a3073

SHA512
9e088fb8a40c79b5143a6f2455da296df8e7e41505311b15b4b30e377913004e375139924875ce46dc050dab3505cd0491e9a529b1d7b183ad661a5d44aed2af

Download Submit
memory/1732-69-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-74-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-57-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-59-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-60-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-61-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-62-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-65-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-68-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-54-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-56-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-75-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-55-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-80-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-81-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-87-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-88-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-93-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-94-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-99-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1732-100-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing