remcos | c1f9bd91fa3c08e550b2069ec8e1193404f7cccffbf9db85e6f2ef4e87625eb2

General

Target

4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe
Size

540KB
MD5

46003a917927235059d68042c451a6ca
SHA1

741885a42d4517939c3a7e003727b12d457f0624
SHA256

4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8
SHA512

046014f7bffa551353e6f445d0b83c1821c6e13730ffb715e6bc90f7f374e012f510f18e6b8b735ddebfd51497d577293b962c4f9b47be7467e4c77c9365a842
SSDEEP

12288:WioEcxmEeHrkc/hopGjiZdJiCb8jSjSbgDW/zmquIuG:WREBEeHrkcWpamECo+jLDW/Kni

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

4.6.0 Light

Botnet

RemoteHost

C2

192.168.175.1:1800

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-04OZR4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 832	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
468	1480	WerFault.exe	26

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	wmpshare.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
832	wmpshare.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 832	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	27
PID 1480 wrote to memory of 832	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	27
PID 1480 wrote to memory of 832	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	27
PID 1480 wrote to memory of 832	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	27
PID 1480 wrote to memory of 832	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	27
PID 1480 wrote to memory of 832	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	27
PID 1480 wrote to memory of 468	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	28
PID 1480 wrote to memory of 468	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	28
PID 1480 wrote to memory of 468	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	28
PID 1480 wrote to memory of 468	1480	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	28

C:\Users\Admin\AppData\Local\Temp\4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe
"C:\Users\Admin\AppData\Local\Temp\4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Windows Media Player\wmpshare.exe
  -arguments
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 320
  2⤵
  - Program crash
  PID:468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-57-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-58-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/832-68-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-69-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-70-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-71-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-72-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-73-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-74-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-75-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-76-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-77-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-78-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-79-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-80-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-81-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-82-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/832-83-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing