remcos | b2823172397c389e1ff948bd03473193ed8527eb19edff06cbb16e2b43ebc19f

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2023, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4500167469.bin.exe
Size 422KB
Sample230904-kce9esfc35
SHA256 b2823172397c389e1ff948bd03473193ed8527eb19edff06cbb16e2b43ebc19f
MD5 fbbaf2b90ebad84ef5251ddbdb22612e
SHA1 1708382ed8a64a5c59477458f34cce13e0aef338
SHA512 e5afe0170946a45a51dfccfa290fd92215fc016bc17eeb0b61f38a53e219263cb4c074051b5f53598e663c7f159123ef631685bdb34ea07339d6faa6d61946b2
SSDEEP 12288:aqijtpLzOSjRb7LX+3SvyjJvnhwZNGn6/Ior:X4Ek57Lu3SvyVv+fGn6/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos livingthings rat

Malware Config

Extracted

Family

remcos

Botnet

livingthings

37.139.129.251:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NRAR41
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Program crash 26 IoCs

pid	pid_target	Process	procid_target
908	700	WerFault.exe	80
4788	700	WerFault.exe	80
3564	700	WerFault.exe	80
3788	700	WerFault.exe	80
4928	700	WerFault.exe	80
3716	700	WerFault.exe	80
4892	700	WerFault.exe	80
4588	700	WerFault.exe	80
4968	700	WerFault.exe	80
2096	700	WerFault.exe	80
4980	700	WerFault.exe	80
2740	700	WerFault.exe	80
4632	700	WerFault.exe	80
4472	700	WerFault.exe	80
2764	700	WerFault.exe	80
1484	700	WerFault.exe	80
2536	700	WerFault.exe	80
3992	700	WerFault.exe	80
3572	700	WerFault.exe	80
3192	700	WerFault.exe	80
3840	700	WerFault.exe	80
4712	700	WerFault.exe	80
4448	700	WerFault.exe	80
2880	700	WerFault.exe	80
1968	700	WerFault.exe	80
2364	700	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
700	4500167469.bin.exe

C:\Users\Admin\AppData\Local\Temp\4500167469.bin.exe
"C:\Users\Admin\AppData\Local\Temp\4500167469.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 620
  2⤵
  - Program crash
  PID:908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 640
  2⤵
  - Program crash
  PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 720
  2⤵
  - Program crash
  PID:3564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 640
  2⤵
  - Program crash
  PID:3788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 760
  2⤵
  - Program crash
  PID:4928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 748
  2⤵
  - Program crash
  PID:3716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 796
  2⤵
  - Program crash
  PID:4892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 808
  2⤵
  - Program crash
  PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 980
  2⤵
  - Program crash
  PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1020
  2⤵
  - Program crash
  PID:2096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1020
  2⤵
  - Program crash
  PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1000
  2⤵
  - Program crash
  PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1112
  2⤵
  - Program crash
  PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1320
  2⤵
  - Program crash
  PID:4472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 828
  2⤵
  - Program crash
  PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1356
  2⤵
  - Program crash
  PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1480
  2⤵
  - Program crash
  PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1476
  2⤵
  - Program crash
  PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 736
  2⤵
  - Program crash
  PID:3572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1472
  2⤵
  - Program crash
  PID:3192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1352
  2⤵
  - Program crash
  PID:3840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1356
  2⤵
  - Program crash
  PID:4712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1316
  2⤵
  - Program crash
  PID:4448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 976
  2⤵
  - Program crash
  PID:2880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 984
  2⤵
  - Program crash
  PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 736
  2⤵
  - Program crash
  PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 700 -ip 700
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 700 -ip 700
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 700 -ip 700
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 700 -ip 700
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 700 -ip 700
1⤵
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 700 -ip 700
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 700 -ip 700
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 700 -ip 700
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 700 -ip 700
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 700 -ip 700
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 700 -ip 700
1⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 700 -ip 700
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 700 -ip 700
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 700 -ip 700
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 700 -ip 700
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 700 -ip 700
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 700 -ip 700
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 700 -ip 700
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 700 -ip 700
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 700 -ip 700
1⤵
PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 700 -ip 700
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 700 -ip 700
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 700 -ip 700
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 700 -ip 700
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 700 -ip 700
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 700 -ip 700
1⤵
PID:3252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 542861bd764dca6609550d45161760abb13459766975cf7ad9c13790a2d8cd2f
MD5 b0643ac11e24314277becfadeac34ab7
SHA1 dc1c2158cebcd4b52c0b3b3bbd26fe9faa5b85d3
SHA512 2b89a21e4963a48f35635355b1562ab4733e406fbddb03cfac4a06f4c6c3bfff2fee1cc55e2f38a0663957b5eba8c4143b21fab75cd2e931f67f356c3af84b58
MD5 SHA1 SHA512

Submit Download

memory/700-17-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-3-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-4-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-6-0x00000000015D0000-0x00000000016D0000-memory.dmp

Download

memory/700-7-0x0000000001530000-0x00000000015AA000-memory.dmp

Download

memory/700-9-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-11-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-14-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-1-0x00000000015D0000-0x00000000016D0000-memory.dmp

Download

memory/700-2-0x0000000001530000-0x00000000015AA000-memory.dmp

Download

memory/700-26-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-23-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-20-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-29-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-32-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-35-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-38-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-41-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-44-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

memory/700-47-0x0000000000400000-0x00000000013CE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads