remcos | 6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3

General

Target

6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe
Size

571KB
MD5

83e968ea79da03bc0e20716cd99d5fcb
SHA1

43234878888b72b4d6e9b7704f5c7715edff72c2
SHA256

6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3
SHA512

0f27f08b933fe2566bbfcc5b99bf748948a35d8e977aa9bb75a45201fec7e1e005462e3b454725142f902906999247634cff533c43002507817f6e7c9fa93162
SSDEEP

12288:PzyVo66yEEb3S797oaquKg0D9BLdlv+z2UtnhWf34kF:ubURl0DBlv+z1nYvZ

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

pekonomia.duckdns.org:30861

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-B0VP4N
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe

description	pid	process	target process
PID 5000 set thread context of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe

pid	process
5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe
5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe

description pid process

Token: SeDebugPrivilege 5000 6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe

description	pid	process
Token: SeDebugPrivilege	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe

description	pid	process	target process
PID 5000 wrote to memory of 4652	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4652	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4652	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe
PID 5000 wrote to memory of 4948	5000	6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe
"C:\Users\Admin\AppData\Local\Temp\6ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:4652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:4948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4948-143-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-155-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-142-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-137-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-138-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-139-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-140-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-141-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-135-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-154-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-147-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-146-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-148-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-149-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-150-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-151-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4948-152-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/5000-134-0x000001AE21720000-0x000001AE21730000-memory.dmp

Filesize
64KB

Download
memory/5000-133-0x000001AE071F0000-0x000001AE07284000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads