remcos | 1ce96a0eb6a0a1c3b3a995bd955d1ba4dad1f452d761fa7dd978aec9e7965031

General

Target

e73ae25fc0adaafd0b7e6adbdc06683f.exe
Size

411KB
MD5

e73ae25fc0adaafd0b7e6adbdc06683f
SHA1

0ef62f41167da3e66f8a99010442f42818312d25
SHA256

1ce96a0eb6a0a1c3b3a995bd955d1ba4dad1f452d761fa7dd978aec9e7965031
SHA512

cc2bb1b322f0882c2f8fee93817c2dc4345f33a38c8672843c2a5d24dc43b4c6c19b690ce7a2f89d07c4dd087e537e440cc5e7984bcd443efdd34abbbfa434a9
SSDEEP

12288:M38GnCBfDq5bl3eOBWTtZSGSODTBCLzLdNBkI2:+blODijLfdNl2

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:55433

185.65.134.166:55433

10.11.0.5:55433

45.128.234.54:55433

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-UQ90W9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
916	e73ae25fc0adaafd0b7e6adbdc06683f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
664	Caspol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 680	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	27
PID 916 wrote to memory of 680	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	27
PID 916 wrote to memory of 680	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	27
PID 916 wrote to memory of 680	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	27
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28
PID 916 wrote to memory of 664	916	e73ae25fc0adaafd0b7e6adbdc06683f.exe	28

C:\Users\Admin\AppData\Local\Temp\e73ae25fc0adaafd0b7e6adbdc06683f.exe
"C:\Users\Admin\AppData\Local\Temp\e73ae25fc0adaafd0b7e6adbdc06683f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-69-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-75-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-56-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-57-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-58-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-59-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-60-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-61-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-62-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-63-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/664-65-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-67-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-68-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-89-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-71-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-88-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-72-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-74-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-70-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-77-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-79-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-80-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-81-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-83-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-85-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/664-87-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/916-54-0x0000000000C20000-0x0000000000C8C000-memory.dmp

Filesize
432KB

Download
memory/916-55-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing