remcos | 3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7

General

Target

2023-02-06 09958758993008RC08838_xls.exe
Size

1.1MB
MD5

447052c646bb789bf73b6bf1d7a18717
SHA1

179633c99b25f73ffc705d9a75c92b1dd7d886a6
SHA256

3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7
SHA512

8fa3cb95a59872f8b232200e64f20a3db992570213e94e17eb5f4e2f3689d121c7fc562f55ed5948eacce200387c0b486df4de9016914948a94dcce02ad93e99
SSDEEP

24576:j1U9BqmycgiH75Bi/vAPwORMFh3TUN7ihBheF:ju9Bqmycr7PYDQVSIF

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

64.112.85.218:4888

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-95RP4I
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

2023-02-06 09958758993008RC08838_xls.exe

description	pid	process	target process
PID 3532 set thread context of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2023-02-06 09958758993008RC08838_xls.exe

description	pid	process	target process
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe
PID 3532 wrote to memory of 4260	3532	2023-02-06 09958758993008RC08838_xls.exe	2023-02-06 09958758993008RC08838_xls.exe

C:\Users\Admin\AppData\Local\Temp\2023-02-06 09958758993008RC08838_xls.exe
"C:\Users\Admin\AppData\Local\Temp\2023-02-06 09958758993008RC08838_xls.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3532

C:\Users\Admin\AppData\Local\Temp\2023-02-06 09958758993008RC08838_xls.exe
"C:\Users\Admin\AppData\Local\Temp\2023-02-06 09958758993008RC08838_xls.exe"
2⤵
PID:4260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3532-133-0x0000000000DC0000-0x0000000000EDE000-memory.dmp

Filesize
1.1MB

Download
memory/3532-134-0x0000000005E00000-0x00000000063A4000-memory.dmp

Filesize
5.6MB

Download
memory/3532-135-0x00000000058F0000-0x0000000005982000-memory.dmp

Filesize
584KB

Download
memory/3532-136-0x00000000058A0000-0x00000000058AA000-memory.dmp

Filesize
40KB

Download
memory/3532-137-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/3532-138-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/3532-139-0x00000000075F0000-0x000000000768C000-memory.dmp

Filesize
624KB

Download
memory/4260-140-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-141-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-143-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-144-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-145-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-146-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-147-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-148-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-151-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-152-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-153-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-154-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-155-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-156-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-157-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-158-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4260-159-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing