remcos | b2d579d3acf45c0fc56208fc51e317632eeb082e596ef05cc196df296884e8a1

General

Target

3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
Size

1.1MB
MD5

447052c646bb789bf73b6bf1d7a18717
SHA1

179633c99b25f73ffc705d9a75c92b1dd7d886a6
SHA256

3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7
SHA512

8fa3cb95a59872f8b232200e64f20a3db992570213e94e17eb5f4e2f3689d121c7fc562f55ed5948eacce200387c0b486df4de9016914948a94dcce02ad93e99
SSDEEP

24576:j1U9BqmycgiH75Bi/vAPwORMFh3TUN7ihBheF:ju9Bqmycr7PYDQVSIF

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

64.112.85.218:4888

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-95RP4I
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe

description	pid	process	target process
PID 5040 set thread context of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe

description	pid	process	target process
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
PID 5040 wrote to memory of 4380	5040	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe	3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe

C:\Users\Admin\AppData\Local\Temp\3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
"C:\Users\Admin\AppData\Local\Temp\3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5040

C:\Users\Admin\AppData\Local\Temp\3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe
"C:\Users\Admin\AppData\Local\Temp\3f07585c2ab00f3f8cb68b6c3a461c0b267c52531a5bca15d59a6cad1cbbc6f7.exe"
2⤵
PID:4380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4380-154-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-155-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-146-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-160-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-147-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-159-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-158-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-148-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-141-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-143-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-144-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-145-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-157-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-156-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-140-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-149-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-152-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4380-153-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5040-133-0x0000000000D40000-0x0000000000E5E000-memory.dmp

Filesize
1.1MB

Download
memory/5040-134-0x0000000005E20000-0x00000000063C4000-memory.dmp

Filesize
5.6MB

Download
memory/5040-137-0x0000000005810000-0x000000000581A000-memory.dmp

Filesize
40KB

Download
memory/5040-135-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/5040-139-0x0000000007230000-0x00000000072CC000-memory.dmp

Filesize
624KB

Download
memory/5040-138-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/5040-136-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing