remcos | fc951d317207c3645bd31be1b7fa508fc95d878c2de11a51a864d885dcec6ea2

General

Target

6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
Size

1.1MB
MD5

d1bfe5dced7785f6ed04ecea70874680
SHA1

cbbbee660f7ea12a16a33a7668e8984661348fc5
SHA256

6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1
SHA512

4f133193de6c9e4443e692191312d9f4eca3acc27dc3156e0990d8a605872d591fd67e867903b81ce2ce9ef9f749440b6930212dfb4f5facb31cbe5d8399dc0d
SSDEEP

24576:n4Ver+iZgnLmcnsISMUgh8yBF6Wh7tOWcRZu+xr6DjOnaZayOjQdLLnz:Wa7MRh8yBF6SBtcHu+x2/ROk1L

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

64.112.85.218:4888

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-95RP4I
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe

description	pid	process	target process
PID 836 set thread context of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe

description	pid	process	target process
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
PID 836 wrote to memory of 780	836	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe	6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe

C:\Users\Admin\AppData\Local\Temp\6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
"C:\Users\Admin\AppData\Local\Temp\6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe
"C:\Users\Admin\AppData\Local\Temp\6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1.exe"
2⤵
PID:780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-70-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-61-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-89-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-88-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-87-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-86-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-85-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-72-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-62-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-63-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-64-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-65-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-66-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-73-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-68-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/780-84-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-83-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-67-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-74-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-75-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-76-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-77-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-78-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-81-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/780-82-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/836-55-0x00000000003A0000-0x00000000003E0000-memory.dmp

Filesize
256KB

Download
memory/836-57-0x00000000003A0000-0x00000000003E0000-memory.dmp

Filesize
256KB

Download
memory/836-60-0x0000000007F50000-0x0000000007FD2000-memory.dmp

Filesize
520KB

Download
memory/836-59-0x0000000007EA0000-0x0000000007F56000-memory.dmp

Filesize
728KB

Download
memory/836-58-0x0000000000880000-0x000000000088C000-memory.dmp

Filesize
48KB

Download
memory/836-54-0x0000000001280000-0x00000000013A4000-memory.dmp

Filesize
1.1MB

Download
memory/836-56-0x0000000000450000-0x0000000000464000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing