remcos | 3e3c56dfdb1df9dc1c9dda065c8cee0da2eebb4139dcd9a3b234bc3de5311547

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0038878c1a923a64ce8f5d81f0304e2a.exe
Size

1.4MB
MD5

0038878c1a923a64ce8f5d81f0304e2a
SHA1

b8e7cdc73977ce555dbbfe9319a3f76513e26352
SHA256

3e3c56dfdb1df9dc1c9dda065c8cee0da2eebb4139dcd9a3b234bc3de5311547
SHA512

75d9f657572ecabfce004586d8658878fbb66894bc512a39e236afdca85006df70e9fe26924c5f2dc63f3901e6914b8ba3086674559d72e789bb81ebae14a66b
SSDEEP

24576:22OS/d3hKzkstksrc5OSs+L2JpIlkdkrALZ/FPS+xsZ1qI1dbXazg7Fy8jh8N6ZK:zKC/s++WlHqyZ1qebKzkON6ZNI

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.1.5 Pro

Botnet

RemoteHost

79.134.225.77:2050

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-PW5C08
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/4284-7-0x00000000053F0000-0x0000000005402000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102
PID 4284 wrote to memory of 1120	4284	0038878c1a923a64ce8f5d81f0304e2a.exe	102

C:\Users\Admin\AppData\Local\Temp\0038878c1a923a64ce8f5d81f0304e2a.exe
"C:\Users\Admin\AppData\Local\Temp\0038878c1a923a64ce8f5d81f0304e2a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\0038878c1a923a64ce8f5d81f0304e2a.exe
  "C:\Users\Admin\AppData\Local\Temp\0038878c1a923a64ce8f5d81f0304e2a.exe"
  2⤵
  PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-15-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1120-18-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1120-12-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1120-13-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1120-16-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4284-4-0x0000000005520000-0x0000000005530000-memory.dmp

Filesize
64KB

Download
memory/4284-5-0x00000000052F0000-0x00000000052FA000-memory.dmp

Filesize
40KB

Download
memory/4284-7-0x00000000053F0000-0x0000000005402000-memory.dmp

Filesize
72KB

Download
memory/4284-8-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/4284-9-0x0000000005520000-0x0000000005530000-memory.dmp

Filesize
64KB

Download
memory/4284-10-0x0000000006350000-0x000000000641E000-memory.dmp

Filesize
824KB

Download
memory/4284-11-0x0000000008820000-0x0000000008898000-memory.dmp

Filesize
480KB

Download
memory/4284-6-0x0000000005630000-0x00000000056CC000-memory.dmp

Filesize
624KB

Download
memory/4284-17-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/4284-0-0x0000000000780000-0x00000000008F6000-memory.dmp

Filesize
1.5MB

Download
memory/4284-3-0x0000000005300000-0x0000000005392000-memory.dmp

Filesize
584KB

Download
memory/4284-2-0x00000000059E0000-0x0000000005F84000-memory.dmp

Filesize
5.6MB

Download
memory/4284-1-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download