remcos | c296470f0a24955e74c6695312974b6f7b32b89147368e84804b47f76d5befa3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

YY.exe
Size

512KB
MD5

5a01a667c84893b0ab403b39b3c73b53
SHA1

61e797ce7faf1a6eca4038b29aac0364fb61fba9
SHA256

c296470f0a24955e74c6695312974b6f7b32b89147368e84804b47f76d5befa3
SHA512

6879d03950b1244f4272859fc3db645aabaa2543015808afeec556f5438be6fd9ab562125b421e160aa61c69342bf2a730cdc3715c0bfaf450c20470d10c9336
SSDEEP

12288:eN44r9HYXzdEXVDBbupm9PwbZxCMhrI5cRdbtF9fgdm1ttt:u9GeXVDmeYFM5cRdJ

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

pekonomiana.duckdns.org:30491

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%Temp%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-EORWFM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 2860	1560	YY.exe	83

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83
PID 1560 wrote to memory of 2860	1560	YY.exe	83

C:\Users\Admin\AppData\Local\Temp\YY.exe
"C:\Users\Admin\AppData\Local\Temp\YY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-133-0x0000022450230000-0x00000224502B4000-memory.dmp

Filesize
528KB

Download
memory/2860-134-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-136-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-137-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-138-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-139-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-140-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-141-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-142-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-143-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-144-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-145-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-146-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-147-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-148-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-149-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-150-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-151-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2860-152-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads