remcos | 1270a5137d1c53725e34eac069b91436aef17863ec1102cc261cf214133444cf

General

Target

702502d248a49746461f351455ba910f.exe
Size

831KB
MD5

702502d248a49746461f351455ba910f
SHA1

0d380acae122897754a815d2fbf039a1832d5606
SHA256

1270a5137d1c53725e34eac069b91436aef17863ec1102cc261cf214133444cf
SHA512

6dbfb587d2936d853b93b0be99a6fc576908bea44a4bc0f73699189491294348597150e273d87c3ad7022d850bb2818e77d763ab34a6bbd36f42da0bed377460
SSDEEP

12288:IkuoqUvAlwjMOIyyQnQyzbJirbbk5vuF1E:LuoaAIlQQyzd4+vu3E

Score

10^/10

remcos sys32 rat

Malware Config

Extracted

Family

remcos

Version

3.2.0 Pro

Botnet

Sys32

C2

135.181.140.182:4783

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Logs
keylog_path
%AppData%
mouse_option
false
mutex
SYS32-S57R8C
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

702502d248a49746461f351455ba910f.exe

description pid process target process

PID 4416 set thread context of 1136 4416 702502d248a49746461f351455ba910f.exe 702502d248a49746461f351455ba910f.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3592 4416 WerFault.exe 702502d248a49746461f351455ba910f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

702502d248a49746461f351455ba910f.exe

description pid process

Token: SeDebugPrivilege 4416 702502d248a49746461f351455ba910f.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

702502d248a49746461f351455ba910f.exe

pid process

1136 702502d248a49746461f351455ba910f.exe

description	pid	process	target process
PID 4416 set thread context of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe

pid	pid_target	process	target process
3592	4416	WerFault.exe	702502d248a49746461f351455ba910f.exe

description	pid	process
Token: SeDebugPrivilege	4416	702502d248a49746461f351455ba910f.exe

pid	process
1136	702502d248a49746461f351455ba910f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

702502d248a49746461f351455ba910f.exe

description	pid	process	target process
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe
PID 4416 wrote to memory of 1136	4416	702502d248a49746461f351455ba910f.exe	702502d248a49746461f351455ba910f.exe

C:\Users\Admin\AppData\Local\Temp\702502d248a49746461f351455ba910f.exe
"C:\Users\Admin\AppData\Local\Temp\702502d248a49746461f351455ba910f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 1636
2⤵
- Program crash
PID:3592

C:\Users\Admin\AppData\Local\Temp\702502d248a49746461f351455ba910f.exe
"C:\Users\Admin\AppData\Local\Temp\702502d248a49746461f351455ba910f.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4416 -ip 4416
1⤵
PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Logs\logs.dat
Filesize
184B

MD5
dc0d452d60e5fa441bbfc6e6af962f36

SHA1
d9784327cdafcca7098c0a3e5dc5847e9b74a7c2

SHA256
a0671ddbb654d87a6db58ed595e9daa46b682f187f44fd84e6754bb3cae673dc

SHA512
c11ccf84fdbd2a6d7ef9dc6aaa5987ba45bb77f97298b5a325f4415b9c4915a56b1729cfb3352908c1da96d0e5b89dfeac6936d92d940c77cf431a52135f3f37

Download Submit
memory/1136-13-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1136-25-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1136-12-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1136-14-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1136-15-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1136-17-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1136-18-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4416-5-0x0000000005390000-0x000000000539A000-memory.dmp

Filesize
40KB

Download
memory/4416-9-0x0000000008520000-0x00000000085BC000-memory.dmp

Filesize
624KB

Download
memory/4416-10-0x0000000008300000-0x000000000835A000-memory.dmp

Filesize
360KB

Download
memory/4416-11-0x0000000008370000-0x0000000008378000-memory.dmp

Filesize
32KB

Download
memory/4416-7-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/4416-8-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/4416-6-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/4416-0-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4416-4-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/4416-3-0x0000000005400000-0x0000000005492000-memory.dmp

Filesize
584KB

Download
memory/4416-19-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4416-2-0x0000000005910000-0x0000000005EB4000-memory.dmp

Filesize
5.6MB

Download
memory/4416-1-0x00000000008C0000-0x0000000000994000-memory.dmp

Filesize
848KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads