remcos | b2d579d3acf45c0fc56208fc51e317632eeb082e596ef05cc196df296884e8a1

General

Target

3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
Size

1.1MB
MD5

447052c646bb789bf73b6bf1d7a18717
SHA1

179633c99b25f73ffc705d9a75c92b1dd7d886a6
SHA256

3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7
SHA512

8fa3cb95a59872f8b232200e64f20a3db992570213e94e17eb5f4e2f3689d121c7fc562f55ed5948eacce200387c0b486df4de9016914948a94dcce02ad93e99
SSDEEP

24576:j1U9BqmycgiH75Bi/vAPwORMFh3TUN7ihBheF:ju9Bqmycr7PYDQVSIF

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

64.112.85.218:4888

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-95RP4I
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe

description	pid	process	target process
PID 1040 set thread context of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe

description	pid	process	target process
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 1040 wrote to memory of 1864	1040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe

C:\Users\Admin\AppData\Local\Temp\3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
"C:\Users\Admin\AppData\Local\Temp\3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1040

C:\Users\Admin\AppData\Local\Temp\3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
"C:\Users\Admin\AppData\Local\Temp\3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe"
2⤵
PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-54-0x0000000000210000-0x000000000032E000-memory.dmp

Filesize
1.1MB

Download
memory/1040-55-0x0000000004F20000-0x0000000004F60000-memory.dmp

Filesize
256KB

Download
memory/1040-56-0x0000000000360000-0x0000000000374000-memory.dmp

Filesize
80KB

Download
memory/1040-57-0x0000000000370000-0x000000000037C000-memory.dmp

Filesize
48KB

Download
memory/1040-58-0x00000000057D0000-0x0000000005886000-memory.dmp

Filesize
728KB

Download
memory/1040-59-0x0000000005880000-0x0000000005902000-memory.dmp

Filesize
520KB

Download
memory/1864-60-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-61-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-64-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-66-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-65-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-63-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-62-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-67-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1864-69-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-71-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-72-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-73-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-74-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-75-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-76-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-77-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-79-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-80-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-81-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-82-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-83-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-84-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-85-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-86-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-87-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1864-88-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing