remcos | 37348f806ccd6dc1d5e7eb76e69f67758ec3f0719dddbc3cb8f18b91e4986e2c

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28f22687e57765334a143a362253b51e.exe
Size

656KB
MD5

28f22687e57765334a143a362253b51e
SHA1

c7740c1b337e66a82bf8bfea8da3de6f51331b8a
SHA256

37348f806ccd6dc1d5e7eb76e69f67758ec3f0719dddbc3cb8f18b91e4986e2c
SHA512

b148c3ff8339cf98d7d807c52bc0bb718bf128654f043d8e40194b1a46cc4bb8fd6fb602075a16fbfb07554269cfc57dab9571eaf0aa6568e5a915b94734d8b3
SSDEEP

12288:1fHOnxytppV0g4V1puDB267ezUs92GFVXZJOkkYZJZ5PIAF:pKy5mg4HpuR8H92qVJjkgJUAF

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.1.5 Pro

Botnet

RemoteHost

ramzy.duckdns.org:2005

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
agent.exe
copy_folder
Remcos
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-RV1M2P
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 2852	1180	28f22687e57765334a143a362253b51e.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1180	28f22687e57765334a143a362253b51e.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	28f22687e57765334a143a362253b51e.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2852	28f22687e57765334a143a362253b51e.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2852	1180	28f22687e57765334a143a362253b51e.exe	28
PID 1180 wrote to memory of 2852	1180	28f22687e57765334a143a362253b51e.exe	28
PID 1180 wrote to memory of 2852	1180	28f22687e57765334a143a362253b51e.exe	28
PID 1180 wrote to memory of 2852	1180	28f22687e57765334a143a362253b51e.exe	28
PID 1180 wrote to memory of 2852	1180	28f22687e57765334a143a362253b51e.exe	28

C:\Users\Admin\AppData\Local\Temp\28f22687e57765334a143a362253b51e.exe
"C:\Users\Admin\AppData\Local\Temp\28f22687e57765334a143a362253b51e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\28f22687e57765334a143a362253b51e.exe
  "C:\Users\Admin\AppData\Local\Temp\28f22687e57765334a143a362253b51e.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-1-0x0000000000220000-0x0000000000320000-memory.dmp

Filesize
1024KB

Download
memory/1180-2-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2852-3-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-5-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-6-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-7-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-8-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-9-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download