remcos | 31fcc1a7c79fa0e760d81e479154824551be394658821275380c9fc45343ae22

Analysis

max time kernel
28s
max time network
36s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-08-2023 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a.exe
Size

257KB
MD5

c6b0de7a393d112604142cdca1605f4a
SHA1

db3f8ae80a2257cf00b8ff421f55753acc1a5081
SHA256

f40f50cc3f6b7ed49501fb4266672d0a8da960e28dc0912688ad0c8d7fb2c1d3
SHA512

83032a2336f0c8b858eddeb9fb940255c5f97469a533de0fd771ff6616d8b3e6bd46e9cc4e1fa30788f1105fba204e8f29f9c9c8f82ef84264904494a839f362
SSDEEP

6144:AHJyyLOaBG2TBf1EYxk8T5t7P5qbGVNqbU7U:AHUlhC/xk8ltFqbYNMU7U

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

2.0.5 Pro

Botnet

RemoteHost

194.68.59.44:9074

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-D19I5H
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

a.exe

description pid process target process

PID 2492 set thread context of 856 2492 a.exe a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a.exe

description pid process

Token: SeDebugPrivilege 2492 a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a.exe

pid process

856 a.exe

description	pid	process	target process
PID 2492 set thread context of 856	2492	a.exe	a.exe

description	pid	process
Token: SeDebugPrivilege	2492	a.exe

pid	process
856	a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a.exe

description	pid	process	target process
PID 2492 wrote to memory of 856	2492	a.exe	a.exe
PID 2492 wrote to memory of 856	2492	a.exe	a.exe
PID 2492 wrote to memory of 856	2492	a.exe	a.exe
PID 2492 wrote to memory of 856	2492	a.exe	a.exe
PID 2492 wrote to memory of 856	2492	a.exe	a.exe
PID 2492 wrote to memory of 856	2492	a.exe	a.exe
PID 2492 wrote to memory of 856	2492	a.exe	a.exe
PID 2492 wrote to memory of 856	2492	a.exe	a.exe
PID 2492 wrote to memory of 856	2492	a.exe	a.exe
PID 2492 wrote to memory of 856	2492	a.exe	a.exe

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/856-75-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-68-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-70-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-59-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-61-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-63-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-65-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-81-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-79-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-57-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-76-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-73-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/856-77-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2492-56-0x0000000000260000-0x00000000002A0000-memory.dmp

Filesize
256KB

Download
memory/2492-71-0x0000000074F10000-0x00000000754BB000-memory.dmp

Filesize
5.7MB

Download
memory/2492-55-0x0000000074F10000-0x00000000754BB000-memory.dmp

Filesize
5.7MB

Download
memory/2492-54-0x0000000074F10000-0x00000000754BB000-memory.dmp

Filesize
5.7MB

Download