remcos | d14d37848f622f44182e8f6788e4a769648c8e301fa485a7b0a3a6f72102aa80

Analysis

max time kernel
105s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230621-es
resource tags

arch:x64arch:x86image:win10v2004-20230621-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/07/2023, 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FACT_ELECTTRONICA_CL-00618263.exe
Size

1023.9MB
MD5

ae2c1d2cc808e549a407289276625ecb
SHA1

bf72ac662b5b5061f294d895fab2321d4ad7e5de
SHA256

7568774315706dbcac14869bfe5a0487107df8dd3c136cfb47af70b03ea280fd
SHA512

d2bdd529f8657edf6747a6ae0422261b3ea3b16ccde3d76f0b480bdda0345847f39a1b15645932aab9941b835aa186c976f0e8bced24615c4a4e3e5bb0d8aa72
SSDEEP

12288:/huqXTFPiWErYExUpklc8XsvP5tBv/enxUbkh7LcB4Jc:5TFPPE3ib8w5tl/arLcB4c

Score

10^/10

remcos nike rat

Malware Config

Extracted

Family

remcos

Botnet

NIKE

benito02.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WM82ER
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3952	2736	WerFault.exe	88

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4344	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 2736	4936	FACT_ELECTTRONICA_CL-00618263.exe	88
PID 4936 wrote to memory of 4708	4936	FACT_ELECTTRONICA_CL-00618263.exe	89
PID 4936 wrote to memory of 4708	4936	FACT_ELECTTRONICA_CL-00618263.exe	89
PID 4936 wrote to memory of 4708	4936	FACT_ELECTTRONICA_CL-00618263.exe	89
PID 4936 wrote to memory of 1056	4936	FACT_ELECTTRONICA_CL-00618263.exe	91
PID 4936 wrote to memory of 1056	4936	FACT_ELECTTRONICA_CL-00618263.exe	91
PID 4936 wrote to memory of 1056	4936	FACT_ELECTTRONICA_CL-00618263.exe	91
PID 4936 wrote to memory of 652	4936	FACT_ELECTTRONICA_CL-00618263.exe	90
PID 4936 wrote to memory of 652	4936	FACT_ELECTTRONICA_CL-00618263.exe	90
PID 4936 wrote to memory of 652	4936	FACT_ELECTTRONICA_CL-00618263.exe	90
PID 1056 wrote to memory of 4344	1056	cmd.exe	95
PID 1056 wrote to memory of 4344	1056	cmd.exe	95
PID 1056 wrote to memory of 4344	1056	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\FACT_ELECTTRONICA_CL-00618263.exe
"C:\Users\Admin\AppData\Local\Temp\FACT_ELECTTRONICA_CL-00618263.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 520
    3⤵
    - Program crash
    PID:3952
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\FACT_ELECTTRONICA_CL-00618263.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:652
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2736 -ip 2736
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-136-0x0000000000680000-0x0000000000701000-memory.dmp

Filesize
516KB

Download
memory/2736-141-0x0000000000680000-0x0000000000701000-memory.dmp

Filesize
516KB

Download
memory/2736-147-0x0000000000680000-0x0000000000701000-memory.dmp

Filesize
516KB

Download
memory/4936-133-0x0000000000E60000-0x0000000000EF2000-memory.dmp

Filesize
584KB

Download
memory/4936-134-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads