remcos | 05a5e41d72b42e2ab08a2b9afce8780ba729f20128a86b83e649df6292a4e7b0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2023, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

TNT Original Invoice.exe
Size

3.0MB
MD5

c8c0264dca37efd9416dd2ec9dd5c931
SHA1

d99726a37eecb89ac7c0e8011617c952ad870762
SHA256

05a5e41d72b42e2ab08a2b9afce8780ba729f20128a86b83e649df6292a4e7b0
SHA512

7fc8bf021d0dd3a9e4997641340de811da87dc6d594e7e082b2a543dfa3fd3563e625797bb9648dcdef1e3830c2d10a9d51a3ac9d7310f930219c3a8fbbd6f52
SSDEEP

24576:7DX7TWfq0acNRVAWEo6E+uSLgaHgDZXhETZjipt/flxGV7hya0eqrmBtngpyyedk:HdNH2XSTZiAVnYD1JzOR1cUabuwHH

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

51.75.209.245:2406

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52YOYG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1568 set thread context of 4016	1568	TNT Original Invoice.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4016	vbc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85
PID 1568 wrote to memory of 4016	1568	TNT Original Invoice.exe	85

C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
12ee9f6d1673118daa4d5217fdb782ee

SHA1
9c1df70b48a199fdec8a902991fe33a579398d10

SHA256
f808de47df5c4e3cfedccb283f63b3503bd9038e451b6cd77fa57257edd1546f

SHA512
b57048fc567231d49641ba3e68f300b39511eda725a567c4f55abf169f28cc9fdd4dc06a8c2054d6204fdae69aeca0c7fdf435dc66082bf5b7e220947bf264af

Download Submit
memory/4016-148-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-153-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-136-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-138-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-147-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-133-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-135-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-154-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-134-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-160-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-161-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-166-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-167-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-172-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-174-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-179-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4016-180-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download