remcos | 6edd2025975d404dd03d29587b323816831ae47fb71f2feef4abf090d5455af2

Analysis

max time kernel
153s
max time network
157s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11-07-2023 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cd7eb198eefb598963f5f963caaf0fd.exe
Size

1024.0MB
MD5

9ae018da102c2ea8f58578d25ce59df2
SHA1

1b0a2c45c27f8e7405754dc699a86f9c08e7aecb
SHA256

c26dcc6aa5d1658a2e3027a13b7edbec7b86aeec2214149952e91e7d01418183
SHA512

c76501d2f5ef7519ecfd69751948737d66f982beae0b723ff8aa5b6071aabb77a1e7d1e253c3a44aec609a0d4861677aa4a631b35e342df0820a59263400f28d
SSDEEP

24576:0GQxrRI0xlAuFbKgKhn8eSWdvAzh46vMGgY6lOPYiLbuN7O0bM2oBq02dmWx1UL5:0rIKlAuvKhnlS+d5OPvsmWxw

Score

10^/10

remcos oro rat

Malware Config

Extracted

Family

remcos

Botnet

ORO

anueljose.con-ip.com:1883

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-F6VG7C
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
896	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
560	AppLaunch.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 560	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	29
PID 2064 wrote to memory of 2896	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	30
PID 2064 wrote to memory of 2896	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	30
PID 2064 wrote to memory of 2896	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	30
PID 2064 wrote to memory of 2896	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	30
PID 2064 wrote to memory of 2344	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	34
PID 2064 wrote to memory of 2344	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	34
PID 2064 wrote to memory of 2344	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	34
PID 2064 wrote to memory of 2344	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	34
PID 2064 wrote to memory of 3052	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	33
PID 2064 wrote to memory of 3052	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	33
PID 2064 wrote to memory of 3052	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	33
PID 2064 wrote to memory of 3052	2064	1cd7eb198eefb598963f5f963caaf0fd.exe	33
PID 2344 wrote to memory of 896	2344	cmd.exe	36
PID 2344 wrote to memory of 896	2344	cmd.exe	36
PID 2344 wrote to memory of 896	2344	cmd.exe	36
PID 2344 wrote to memory of 896	2344	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\1cd7eb198eefb598963f5f963caaf0fd.exe
"C:\Users\Admin\AppData\Local\Temp\1cd7eb198eefb598963f5f963caaf0fd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:560
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\1cd7eb198eefb598963f5f963caaf0fd.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:3052
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
468df64628fb21491c12e1244e0d8c20

SHA1
cc37bf6ac634abacae40d9096a0dda1d5c5519bd

SHA256
bb7aee6769f4951f7a4be049ffbe382fce454e712812e371fa6a59e4a770c855

SHA512
5c09825ed7ed18ec4e23917ad19bad1fff7a68c995e1f6b309d2a94473f54abdf69b7a554a928b9bc5c2c6bce625562014b7ebe25918b92362dcd7df4943af19

Download Submit
memory/560-62-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-114-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-58-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-60-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-59-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-57-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-82-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-81-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-63-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-64-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/560-66-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-71-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-76-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-77-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-122-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-56-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-61-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-83-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-84-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-85-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-87-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-91-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-92-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-121-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-98-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-99-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-106-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-107-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-113-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/560-78-0x0000000000090000-0x0000000000111000-memory.dmp

Filesize
516KB

Download
memory/2064-55-0x0000000005060000-0x00000000050A0000-memory.dmp

Filesize
256KB

Download
memory/2064-54-0x0000000000C70000-0x00000000018FA000-memory.dmp

Filesize
12.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads