remcos | 73cb25c9129d5d9b51766e6efe54c27cfa70defbd43fa003d7b1245b449f7722

Analysis

max time kernel
154s
max time network
167s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/06/2023, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34986689526a986f09c61c45185a4581.exe
Size

1024.0MB
MD5

be6bc5b118e0e19f09dd4b8a98a84f46
SHA1

9badc3c3f408e3031ed598d5d02f90f6fc5fb8c5
SHA256

be0a17f55ad9f4dcf1e45b6fca28902ba2f821aa215d65b690b8f91cdfca8b59
SHA512

757659ed1708880b7bcfcc3c18b9e7bccfc5823932558fe27f85ae69eceeaeadc49f385cf6187f29f0e3a9e8474d0b4f5683039d544c652ef636809806eb8e6f
SSDEEP

24576:a/8mm44MRdxUAx7Af/8s5OdvAnVUKb0OUImZOv0iLbuN7O0bM2o9KgC9ayRtknbJ:WIB5+55Ov3cayRE

Score

10^/10

remcos oro rat

Malware Config

Extracted

Family

remcos

Botnet

ORO

olkmnbftyujbvfd.con-ip.com:1883

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QZT2TS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1084 set thread context of 2024	1084	34986689526a986f09c61c45185a4581.exe	26

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1752	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2024	csc.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 2024	1084	34986689526a986f09c61c45185a4581.exe	26
PID 1084 wrote to memory of 800	1084	34986689526a986f09c61c45185a4581.exe	27
PID 1084 wrote to memory of 800	1084	34986689526a986f09c61c45185a4581.exe	27
PID 1084 wrote to memory of 800	1084	34986689526a986f09c61c45185a4581.exe	27
PID 1084 wrote to memory of 800	1084	34986689526a986f09c61c45185a4581.exe	27
PID 1084 wrote to memory of 2020	1084	34986689526a986f09c61c45185a4581.exe	32
PID 1084 wrote to memory of 2020	1084	34986689526a986f09c61c45185a4581.exe	32
PID 1084 wrote to memory of 2020	1084	34986689526a986f09c61c45185a4581.exe	32
PID 1084 wrote to memory of 2020	1084	34986689526a986f09c61c45185a4581.exe	32
PID 1084 wrote to memory of 1688	1084	34986689526a986f09c61c45185a4581.exe	31
PID 1084 wrote to memory of 1688	1084	34986689526a986f09c61c45185a4581.exe	31
PID 1084 wrote to memory of 1688	1084	34986689526a986f09c61c45185a4581.exe	31
PID 1084 wrote to memory of 1688	1084	34986689526a986f09c61c45185a4581.exe	31
PID 2020 wrote to memory of 1752	2020	cmd.exe	33
PID 2020 wrote to memory of 1752	2020	cmd.exe	33
PID 2020 wrote to memory of 1752	2020	cmd.exe	33
PID 2020 wrote to memory of 1752	2020	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\34986689526a986f09c61c45185a4581.exe
"C:\Users\Admin\AppData\Local\Temp\34986689526a986f09c61c45185a4581.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2024
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:800
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\34986689526a986f09c61c45185a4581.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 25 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 25 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
3229c7a7d81dc33afdc2b81c587a3086

SHA1
cafa7b157a0c3293e96187b85f659fce3a6c88eb

SHA256
487a5547d69b53742c27e797ef053aaecf73e42a6162b63b89c67706d772dae4

SHA512
b7874961677026f847f0283128f4835e8e4205c350cb18998a5dfa77d03f42842d24838766e7e98a1cb86e790f4e966d0e89a9fcf886760d9cfa3cbdacb695d2

Download Submit
memory/1084-64-0x0000000005630000-0x0000000005670000-memory.dmp

Filesize
256KB

Download
memory/1084-54-0x0000000000950000-0x00000000015DA000-memory.dmp

Filesize
12.5MB

Download
memory/2024-72-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-87-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-59-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-58-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-61-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-62-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-63-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2024-57-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-65-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-67-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-70-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-68-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-71-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-56-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-60-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-81-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-73-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-82-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-55-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-79-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-88-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-93-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-95-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-100-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-101-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-106-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-107-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-112-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2024-113-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads