remcos | 80ea9f71426b05efb585d8d8807321a5aa8f652be7cf79e91c518cbda0b424fc

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06-06-2023 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

490KB
MD5

5a1d6b58b782aeeb8f22eedbea613aef
SHA1

8d67d82555b2b9bcf1b31c3831831190da46711e
SHA256

80ea9f71426b05efb585d8d8807321a5aa8f652be7cf79e91c518cbda0b424fc
SHA512

0106df5a720b7858a2d74c14bd16318a5e1c93bb8449baa941ab9f5e0634935c91efcde2c806da36751e1a80da4f59aac07446d0a58a5f9fc3a8f373c24ab86b
SSDEEP

12288:E6O1ShV5nKV6kfHRmyoCh+qmwmkD9am8nJ3FM6:/qxZoCh53kPrM6

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

pekonomia.duckdns.org:30861

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-B0VP4N
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1496 set thread context of 1964 1496 file.exe Caspol.exe

description	pid	process	target process
PID 1496 set thread context of 1964	1496	file.exe	Caspol.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe
PID 1496 wrote to memory of 1964	1496	file.exe	Caspol.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
2⤵
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-54-0x0000000000A70000-0x0000000000AF0000-memory.dmp

Filesize
512KB

Download
memory/1496-55-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download
memory/1964-56-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-57-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-58-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-59-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-60-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-61-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-62-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-63-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1964-65-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-67-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-68-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-69-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-70-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-71-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-72-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-73-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-74-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-75-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-76-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-77-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-78-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-79-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-80-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-81-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-82-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-83-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-84-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-85-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-86-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-87-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-88-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-89-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-90-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-91-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-92-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-93-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-94-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-95-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-96-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-97-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-98-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-99-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-100-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-101-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-102-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-103-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-104-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-105-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-106-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-107-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-108-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-109-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-110-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-111-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-112-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-113-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-114-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-115-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-116-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-117-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-118-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-119-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1964-120-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download