remcos | b2d5e15268cb130c995118e17afa1198ca19604a20b91f1907a7ef18210db30f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HB23090003.exe
Size 587KB
Sample230901-pp2emsfa28
SHA256 b2d5e15268cb130c995118e17afa1198ca19604a20b91f1907a7ef18210db30f
MD5 1becaa0726bae1f669da8d39ac13509b
SHA1 43df013242f0172059e8df21e29215b14c1837c9
SHA512 d24eb2b9fa443458f37510095597214ab83fcd1124344405e3d0eb180dd80a1c345e7d21fdf3fb04f5d3a2691a15c606c9e719e70977decf7579a32479897f29
SSDEEP 12288:kBkhRxDIusx/JyqVMdFYiUgam+XodmA+Ae+cgLUeL/:OkhbZsRJy8Md6iUNnX1RZgLHL/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos working rat

Malware Config

Extracted

Family

remcos

Botnet

working

37.139.129.251:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-O79KJZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Program crash 24 IoCs

pid	pid_target	Process	procid_target
2560	4404	WerFault.exe	79
988	4404	WerFault.exe	79
1864	4404	WerFault.exe	79
4656	4404	WerFault.exe	79
1120	4404	WerFault.exe	79
4496	4404	WerFault.exe	79
524	4404	WerFault.exe	79
4252	4404	WerFault.exe	79
3620	4404	WerFault.exe	79
228	4404	WerFault.exe	79
3600	4404	WerFault.exe	79
4836	4404	WerFault.exe	79
4116	4404	WerFault.exe	79
4856	4404	WerFault.exe	79
3044	4404	WerFault.exe	79
2240	4404	WerFault.exe	79
4696	4404	WerFault.exe	79
3884	4404	WerFault.exe	79
968	4404	WerFault.exe	79
2968	4404	WerFault.exe	79
2868	4404	WerFault.exe	79
2744	4404	WerFault.exe	79
3760	4404	WerFault.exe	79
2524	4404	WerFault.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4404	HB23090003.exe

C:\Users\Admin\AppData\Local\Temp\HB23090003.exe
"C:\Users\Admin\AppData\Local\Temp\HB23090003.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 664
  2⤵
  - Program crash
  PID:2560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 704
  2⤵
  - Program crash
  PID:988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 724
  2⤵
  - Program crash
  PID:1864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 728
  2⤵
  - Program crash
  PID:4656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 756
  2⤵
  - Program crash
  PID:1120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 772
  2⤵
  - Program crash
  PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 804
  2⤵
  - Program crash
  PID:524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 764
  2⤵
  - Program crash
  PID:4252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 976
  2⤵
  - Program crash
  PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 996
  2⤵
  - Program crash
  PID:228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 996
  2⤵
  - Program crash
  PID:3600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1052
  2⤵
  - Program crash
  PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1116
  2⤵
  - Program crash
  PID:4116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1192
  2⤵
  - Program crash
  PID:4856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 776
  2⤵
  - Program crash
  PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 796
  2⤵
  - Program crash
  PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1340
  2⤵
  - Program crash
  PID:4696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 908
  2⤵
  - Program crash
  PID:3884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1344
  2⤵
  - Program crash
  PID:968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1432
  2⤵
  - Program crash
  PID:2968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1524
  2⤵
  - Program crash
  PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1516
  2⤵
  - Program crash
  PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1496
  2⤵
  - Program crash
  PID:3760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 972
  2⤵
  - Program crash
  PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4404 -ip 4404
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4404 -ip 4404
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4404 -ip 4404
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4404 -ip 4404
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4404 -ip 4404
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4404 -ip 4404
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4404 -ip 4404
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4404 -ip 4404
1⤵
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4404 -ip 4404
1⤵
PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4404 -ip 4404
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4404 -ip 4404
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4404 -ip 4404
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4404 -ip 4404
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4404 -ip 4404
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4404 -ip 4404
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4404 -ip 4404
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4404 -ip 4404
1⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4404 -ip 4404
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4404 -ip 4404
1⤵
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4404 -ip 4404
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4404 -ip 4404
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4404 -ip 4404
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4404 -ip 4404
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4404 -ip 4404
1⤵
PID:3240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 69204aba5ace84e2a802fe3c462f1b19e0e671700f4514b0e6069d2f93382f75
MD5 e43df800e66e85234b7f47c0b6086e7a
SHA1 78ae077f7c13009e0a0f376245ee2eae302711b7
SHA512 db7b0cceebd1c5bb74cb90af50a0f744c649fa5a4252693b6c1bfd2e444bc2b75641c636d77288322eb2891f83965d44d56d261b59a7efb85812ba1acbc46619
MD5 SHA1 SHA512

Submit Download

memory/4404-16-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-19-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-3-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-0-0x0000000002730000-0x0000000002777000-memory.dmp

Download

memory/4404-6-0x0000000004250000-0x00000000042CA000-memory.dmp

Download

memory/4404-7-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-10-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-13-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-2-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-1-0x0000000004250000-0x00000000042CA000-memory.dmp

Download

memory/4404-4-0x0000000002730000-0x0000000002777000-memory.dmp

Download

memory/4404-22-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-25-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-28-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-31-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-34-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-37-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-40-0x0000000000400000-0x0000000002482000-memory.dmp

Download

memory/4404-43-0x0000000000400000-0x0000000002482000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads