remcos | f4ab4a125eaf218adb62d4a458ac26f872505c95ea837cc586f92bbdb2d6ac8a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2023 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TNT Original Invoice.exe
Size

3.0MB
MD5

c8c0264dca37efd9416dd2ec9dd5c931
SHA1

d99726a37eecb89ac7c0e8011617c952ad870762
SHA256

05a5e41d72b42e2ab08a2b9afce8780ba729f20128a86b83e649df6292a4e7b0
SHA512

7fc8bf021d0dd3a9e4997641340de811da87dc6d594e7e082b2a543dfa3fd3563e625797bb9648dcdef1e3830c2d10a9d51a3ac9d7310f930219c3a8fbbd6f52
SSDEEP

24576:7DX7TWfq0acNRVAWEo6E+uSLgaHgDZXhETZjipt/flxGV7hya0eqrmBtngpyyedk:HdNH2XSTZiAVnYD1JzOR1cUabuwHH

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

51.75.209.245:2406

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52YOYG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

TNT Original Invoice.exe

description pid process target process

PID 4132 set thread context of 4668 4132 TNT Original Invoice.exe vbc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

4668 vbc.exe

description	pid	process	target process
PID 4132 set thread context of 4668	4132	TNT Original Invoice.exe	vbc.exe

pid	process
4668	vbc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

TNT Original Invoice.exe

description	pid	process	target process
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe
PID 4132 wrote to memory of 4668	4132	TNT Original Invoice.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4132

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
b500d70a1bab19add55e71384a83f6ea

SHA1
81fc2a5ddf4a394bb3a5fb1b210a429d9f80ca59

SHA256
0ce4fef6ba5c155cb2365f19710604bb7dc612654dcd96d72797bad90c6bd7e0

SHA512
28b1846cd529cbbc470c8b3307fc17d429c32bf1f1ebe843809e1aec1d71a6b3854a5670ea3e003b3bb2cc31bef5db02f5f2c63f084a816962d23bffde9a5023

Download Submit
memory/4668-147-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-181-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-144-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-145-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-134-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-148-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-149-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-160-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-187-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-139-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-154-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-161-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-167-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-168-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-173-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-174-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-179-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-133-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-186-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4668-155-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download