remcos | f4ab4a125eaf218adb62d4a458ac26f872505c95ea837cc586f92bbdb2d6ac8a

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29-03-2023 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TNT Original Invoice.exe
Size

3.0MB
MD5

c8c0264dca37efd9416dd2ec9dd5c931
SHA1

d99726a37eecb89ac7c0e8011617c952ad870762
SHA256

05a5e41d72b42e2ab08a2b9afce8780ba729f20128a86b83e649df6292a4e7b0
SHA512

7fc8bf021d0dd3a9e4997641340de811da87dc6d594e7e082b2a543dfa3fd3563e625797bb9648dcdef1e3830c2d10a9d51a3ac9d7310f930219c3a8fbbd6f52
SSDEEP

24576:7DX7TWfq0acNRVAWEo6E+uSLgaHgDZXhETZjipt/flxGV7hya0eqrmBtngpyyedk:HdNH2XSTZiAVnYD1JzOR1cUabuwHH

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

51.75.209.245:2406

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52YOYG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

TNT Original Invoice.exe

description pid process target process

PID 1960 set thread context of 1944 1960 TNT Original Invoice.exe vbc.exe

description	pid	process	target process
PID 1960 set thread context of 1944	1960	TNT Original Invoice.exe	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

TNT Original Invoice.exe

description	pid	process	target process
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe
PID 1960 wrote to memory of 1944	1960	TNT Original Invoice.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1944

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/1944-55-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/1944-60-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/1944-65-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download