remcos | 477cb83fd991d5267507f61b98b7f7523a2ae79bcb1f2e52a71d9daa20b0b93e

Analysis

max time kernel
170s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2023 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a.exe
Size

257KB
MD5

c6b0de7a393d112604142cdca1605f4a
SHA1

db3f8ae80a2257cf00b8ff421f55753acc1a5081
SHA256

f40f50cc3f6b7ed49501fb4266672d0a8da960e28dc0912688ad0c8d7fb2c1d3
SHA512

83032a2336f0c8b858eddeb9fb940255c5f97469a533de0fd771ff6616d8b3e6bd46e9cc4e1fa30788f1105fba204e8f29f9c9c8f82ef84264904494a839f362
SSDEEP

6144:AHJyyLOaBG2TBf1EYxk8T5t7P5qbGVNqbU7U:AHUlhC/xk8ltFqbYNMU7U

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

2.0.5 Pro

Botnet

RemoteHost

194.68.59.44:9074

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-D19I5H
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

a.exe

description pid process target process

PID 3460 set thread context of 3956 3460 a.exe a.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

a.exeAUDIODG.EXE

description pid process

Token: SeDebugPrivilege 3460 a.exe
Token: 33 1728 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 1728 AUDIODG.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a.exe

pid process

3956 a.exe

description	pid	process	target process
PID 3460 set thread context of 3956	3460	a.exe	a.exe

description	pid	process
Token: SeDebugPrivilege	3460	a.exe
Token: 33	1728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1728	AUDIODG.EXE

pid	process
3956	a.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a.exe

description	pid	process	target process
PID 3460 wrote to memory of 3956	3460	a.exe	a.exe
PID 3460 wrote to memory of 3956	3460	a.exe	a.exe
PID 3460 wrote to memory of 3956	3460	a.exe	a.exe
PID 3460 wrote to memory of 3956	3460	a.exe	a.exe
PID 3460 wrote to memory of 3956	3460	a.exe	a.exe
PID 3460 wrote to memory of 3956	3460	a.exe	a.exe
PID 3460 wrote to memory of 3956	3460	a.exe	a.exe
PID 3460 wrote to memory of 3956	3460	a.exe	a.exe
PID 3460 wrote to memory of 3956	3460	a.exe	a.exe

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3956

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x320
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
79B

MD5
c8e0f5edc86c933d0ae7f33fda7265ed

SHA1
d7e138091c86f28b15a9e7eae2b3ce93695edf9d

SHA256
a15cf55ebe3087a033e909e8f10f87b4742e65831934584faeff2bdfe4a2a84f

SHA512
1b68a6554bd020721441a1b451643fb1f5b9556adc00db3983c5837185f00b418b2df64f52b4fe59cda40a6a22d475c5532263d23be3764b0a17a85e1fb1eea6

Download Submit
memory/3460-0-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/3460-1-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/3460-2-0x00000000010A0000-0x00000000010B0000-memory.dmp

Filesize
64KB

Download
memory/3460-6-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/3956-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-23-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-9-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-16-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-18-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-20-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-21-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-25-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-27-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-29-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-31-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-33-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-35-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3956-39-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download