remcos | c1f9bd91fa3c08e550b2069ec8e1193404f7cccffbf9db85e6f2ef4e87625eb2

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe
Size

540KB
MD5

46003a917927235059d68042c451a6ca
SHA1

741885a42d4517939c3a7e003727b12d457f0624
SHA256

4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8
SHA512

046014f7bffa551353e6f445d0b83c1821c6e13730ffb715e6bc90f7f374e012f510f18e6b8b735ddebfd51497d577293b962c4f9b47be7467e4c77c9365a842
SSDEEP

12288:WioEcxmEeHrkc/hopGjiZdJiCb8jSjSbgDW/zmquIuG:WREBEeHrkcWpamECo+jLDW/Kni

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

4.6.0 Light

Botnet

RemoteHost

192.168.175.1:1800

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-04OZR4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 2412	4652	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4696	4652	WerFault.exe	82

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	wmpshare.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2412	wmpshare.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4652	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2412	4652	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	83
PID 4652 wrote to memory of 2412	4652	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	83
PID 4652 wrote to memory of 2412	4652	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	83
PID 4652 wrote to memory of 2412	4652	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	83
PID 4652 wrote to memory of 2412	4652	4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe	83

C:\Users\Admin\AppData\Local\Temp\4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe
"C:\Users\Admin\AppData\Local\Temp\4d20cc81fe3369624b78b05419fea8efdf9f147fa13ff541561ae4298b3c5ad8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Windows Media Player\wmpshare.exe
  -arguments
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 624
  2⤵
  - Program crash
  PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4652 -ip 4652
1⤵
PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-136-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-145-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-146-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-147-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-148-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-149-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-150-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-151-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-152-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-153-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-154-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-155-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-156-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-157-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-158-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-159-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2412-160-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download