remcos | 75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e

General

Target

75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe
Size

909KB
MD5

4853aa5ad98757a756f1acfe1bed460d
SHA1

816027f9fbce3d22624db698ede23a2d4cc25023
SHA256

75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e
SHA512

756dc810b13bf18bad2495b78afbfd0fee281de55eadc5a24b2ebd4ece60bffba01420f3edcc42994500d5978a277e832fb8627c058a2a7cac52bfcb25065097
SSDEEP

24576:F+1IOE/QNWkphcu3WGMPBGqHsOGCP9xMS5RkP5:F+1XrhcuW3GqBGCP9x/5RK5

Score

10^/10

remcos thcinc rat

Malware Config

Extracted

Family

remcos

Botnet

Thcinc

C2

b6079658.sytes.net:6110

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
thcinc.exe
copy_folder
Thcinc
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
thcinc
mouse_option
false
mutex
Rmc-X26LV5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
632	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90
PID 4460 wrote to memory of 632	4460	75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe	90

C:\Users\Admin\AppData\Local\Temp\75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe
"C:\Users\Admin\AppData\Local\Temp\75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e_JC.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\thcinc\logs.dat

Filesize
144B

MD5
1c79419766ff2c536eb9129d2ee1d024

SHA1
53138dc65e840d5ca133d594f9df502e4398a6c3

SHA256
6c6f1395356954319283cb428465f37b61b21a1526ec7ffed8f84a08ccc6e6d9

SHA512
615f5bc321c2f41a47778f169577fe776503d4f0740f808d27fc319f8dadf0691fa785b5e4c5cd34187286c02031820d417626b1c4129ef28a6ab53f06b1ed58

Download Submit
memory/632-163-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-159-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-188-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-187-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-150-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-179-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-172-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-147-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-142-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-144-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-164-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-146-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-148-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-171-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-154-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-151-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-152-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/632-153-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4460-138-0x00000000055C0000-0x00000000055CA000-memory.dmp

Filesize
40KB

Download
memory/4460-135-0x0000000005B40000-0x00000000060E4000-memory.dmp

Filesize
5.6MB

Download
memory/4460-133-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/4460-145-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/4460-134-0x0000000000AD0000-0x0000000000BBA000-memory.dmp

Filesize
936KB

Download
memory/4460-141-0x0000000009BE0000-0x0000000009C7C000-memory.dmp

Filesize
624KB

Download
memory/4460-140-0x00000000057D0000-0x00000000057E0000-memory.dmp

Filesize
64KB

Download
memory/4460-139-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/4460-137-0x00000000057D0000-0x00000000057E0000-memory.dmp

Filesize
64KB

Download
memory/4460-136-0x0000000005630000-0x00000000056C2000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing