remcos | 5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4

General

Target

5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe
Size

885KB
MD5

a97f1c6922b2b559c7f9c5114f1b59c3
SHA1

40fcc0e5f3b23349d5d96a1563948ebe155f9fa9
SHA256

5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4
SHA512

158208563fe97ecdb4a67b148360081571823d512cb3339be329ee36f47038d312c15457dc32b0fb6fe82b9e670a036c19b399b2c434d684fa1ddd06de530d2d
SSDEEP

24576:R+f55qeCiUlgtCg0mEk4Q2oPYYaeu5gUJZ8y:Yf55CJK4mEk4Q2oQYDSpJZ

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

167.114.189.33:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7ZDF66
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 408 set thread context of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
400	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102
PID 408 wrote to memory of 400	408	5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe	102

C:\Users\Admin\AppData\Local\Temp\5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe
"C:\Users\Admin\AppData\Local\Temp\5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:408
- C:\Users\Admin\AppData\Local\Temp\5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe
  "C:\Users\Admin\AppData\Local\Temp\5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
64c0b94b55da375ebffc2d27d2df1ece

SHA1
10e420d271861b76a4d6d0085c821d21e5dce19c

SHA256
c5b7240f3ba9df18b85213d2ccf83863d8634b0f81d3cb9d9afbf2948a771bc0

SHA512
5921e04885334ce4cc0ca6c400671fe8e728e17f080c683b4e9df40bf6b2b71611a9dfb6f6510dfd47c0f88cf959383876e7cd1b0f008fed79abe5059e10dc5f

Download Submit
memory/400-27-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-26-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-46-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-45-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-21-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-40-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-38-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-15-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-32-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-12-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-16-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-13-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-19-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-33-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/400-20-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/408-4-0x0000000005110000-0x0000000005120000-memory.dmp

Filesize
64KB

Download
memory/408-2-0x0000000005550000-0x0000000005AF4000-memory.dmp

Filesize
5.6MB

Download
memory/408-17-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/408-11-0x0000000008050000-0x0000000008108000-memory.dmp

Filesize
736KB

Download
memory/408-10-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/408-9-0x0000000005110000-0x0000000005120000-memory.dmp

Filesize
64KB

Download
memory/408-0-0x0000000000520000-0x0000000000604000-memory.dmp

Filesize
912KB

Download
memory/408-5-0x0000000004F60000-0x0000000004F6A000-memory.dmp

Filesize
40KB

Download
memory/408-8-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/408-7-0x00000000053E0000-0x00000000053F8000-memory.dmp

Filesize
96KB

Download
memory/408-6-0x00000000052B0000-0x000000000534C000-memory.dmp

Filesize
624KB

Download
memory/408-1-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/408-3-0x0000000004EA0000-0x0000000004F32000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing