remcos | d14d37848f622f44182e8f6788e4a769648c8e301fa485a7b0a3a6f72102aa80

Analysis

max time kernel
162s
max time network
162s
platform
windows7_x64
resource
win7-20230621-es
resource tags

arch:x64arch:x86image:win7-20230621-eslocale:es-esos:windows7-x64systemwindows
submitted
02/07/2023, 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FACT_ELECTTRONICA_CL-00618263.exe
Size

1023.9MB
MD5

ae2c1d2cc808e549a407289276625ecb
SHA1

bf72ac662b5b5061f294d895fab2321d4ad7e5de
SHA256

7568774315706dbcac14869bfe5a0487107df8dd3c136cfb47af70b03ea280fd
SHA512

d2bdd529f8657edf6747a6ae0422261b3ea3b16ccde3d76f0b480bdda0345847f39a1b15645932aab9941b835aa186c976f0e8bced24615c4a4e3e5bb0d8aa72
SSDEEP

12288:/huqXTFPiWErYExUpklc8XsvP5tBv/enxUbkh7LcB4Jc:5TFPPE3ib8w5tl/arLcB4c

Score

10^/10

remcos nike rat

Malware Config

Extracted

Family

remcos

Botnet

NIKE

benito02.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WM82ER
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 612 set thread context of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
760	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1348	csc.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 1348	612	FACT_ELECTTRONICA_CL-00618263.exe	28
PID 612 wrote to memory of 988	612	FACT_ELECTTRONICA_CL-00618263.exe	29
PID 612 wrote to memory of 988	612	FACT_ELECTTRONICA_CL-00618263.exe	29
PID 612 wrote to memory of 988	612	FACT_ELECTTRONICA_CL-00618263.exe	29
PID 612 wrote to memory of 988	612	FACT_ELECTTRONICA_CL-00618263.exe	29
PID 612 wrote to memory of 1504	612	FACT_ELECTTRONICA_CL-00618263.exe	30
PID 612 wrote to memory of 1504	612	FACT_ELECTTRONICA_CL-00618263.exe	30
PID 612 wrote to memory of 1504	612	FACT_ELECTTRONICA_CL-00618263.exe	30
PID 612 wrote to memory of 1504	612	FACT_ELECTTRONICA_CL-00618263.exe	30
PID 612 wrote to memory of 664	612	FACT_ELECTTRONICA_CL-00618263.exe	32
PID 612 wrote to memory of 664	612	FACT_ELECTTRONICA_CL-00618263.exe	32
PID 612 wrote to memory of 664	612	FACT_ELECTTRONICA_CL-00618263.exe	32
PID 612 wrote to memory of 664	612	FACT_ELECTTRONICA_CL-00618263.exe	32
PID 1504 wrote to memory of 760	1504	cmd.exe	35
PID 1504 wrote to memory of 760	1504	cmd.exe	35
PID 1504 wrote to memory of 760	1504	cmd.exe	35
PID 1504 wrote to memory of 760	1504	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\FACT_ELECTTRONICA_CL-00618263.exe
"C:\Users\Admin\AppData\Local\Temp\FACT_ELECTTRONICA_CL-00618263.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:988
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\FACT_ELECTTRONICA_CL-00618263.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
872c2dce76faafbca5abc5008d8a2832

SHA1
0342dd702183b5b628924989643fc9c9a222c9c4

SHA256
a9b43cb1d56d0cb966c01675f13abe338993a31592ea190ad29eccb5a182e156

SHA512
0c532e3ab5e67ad9b899f8b9b797df65421a230318ec7293abd632f48ef972942592a75604eb6558ec7f1868bc3e609f730d8e752d00852733f475e77be26a9e

Download Submit
memory/612-76-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/612-54-0x0000000000D20000-0x0000000000DB2000-memory.dmp

Filesize
584KB

Download
memory/1348-77-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-81-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-59-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-60-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-61-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-62-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-63-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1348-65-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-70-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-75-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-57-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-56-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-80-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-58-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-88-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-89-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-55-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-94-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-95-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-100-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-102-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-107-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-108-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-113-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1348-114-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads