remcos | d512aae6332400529ace4e7b466bf545c4031d3c54fe36d4fe88f322ff71c7c6

Analysis

max time kernel
179s
max time network
177s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ofx RAD05001 40 03 013 2024 00450 00.exe
Size

1023.9MB
MD5

76d8531f558cf1e45387137a1b91670f
SHA1

82a4a9a3369c7b5610c38cf68cdee4c43f21d323
SHA256

bf20c21df71040b3cf3b9ad5ce6fb0d97fceccdb9e9d547a80d9f5abe46437ca
SHA512

4b14d8ca43790fc3680cde1094017fe81f9eec204b7f7c3c9bfe0e1694683bd6e0e3fd752bae04fb0f20f7fa3da0bfe3731549da1bf18132fdf6a9bf8beb7d3a
SSDEEP

12288:4GBgEAeHszumED9CS8RwvWV9fV8S4Y2QYFz43VxRW:hBgEApqmWmwE9fiBj8fRW

Score

10^/10

remcos jordan rat

Malware Config

Extracted

Family

remcos

Botnet

JORDAN

amapola.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YTQPQ7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3056 set thread context of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2728	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2744	csc.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2744	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	28
PID 3056 wrote to memory of 2700	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	29
PID 3056 wrote to memory of 2700	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	29
PID 3056 wrote to memory of 2700	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	29
PID 3056 wrote to memory of 2700	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	29
PID 3056 wrote to memory of 2772	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	31
PID 3056 wrote to memory of 2772	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	31
PID 3056 wrote to memory of 2772	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	31
PID 3056 wrote to memory of 2772	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	31
PID 2772 wrote to memory of 2728	2772	cmd.exe	33
PID 2772 wrote to memory of 2728	2772	cmd.exe	33
PID 2772 wrote to memory of 2728	2772	cmd.exe	33
PID 2772 wrote to memory of 2728	2772	cmd.exe	33
PID 3056 wrote to memory of 2560	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	34
PID 3056 wrote to memory of 2560	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	34
PID 3056 wrote to memory of 2560	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	34
PID 3056 wrote to memory of 2560	3056	Ofx RAD05001 40 03 013 2024 00450 00.exe	34

C:\Users\Admin\AppData\Local\Temp\Ofx RAD05001 40 03 013 2024 00450 00.exe
"C:\Users\Admin\AppData\Local\Temp\Ofx RAD05001 40 03 013 2024 00450 00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\Ofx RAD05001 40 03 013 2024 00450 00.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
bd98bd92adc3eb4eb5a2515def34e50b

SHA1
44a836f87896f9c99c67a2830e02d8ad97bd301b

SHA256
6fbd79cbab04962b1f0256e327fffedc31619b96c8a82a6dd5332cbd0b2edbcd

SHA512
432bed286e81dca76f14e7695524589eb6fc88823e9e46d3af427ca9f25fd6d0f0c038fb902f33235162aa59a695d078cd6d686eb8898d25cc5d3f15690ba076

Download Submit
memory/2744-59-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-58-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-3-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-5-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-7-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-8-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-10-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-12-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-14-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-25-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-20-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-18-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2744-16-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-31-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-30-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-34-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-86-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-85-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-40-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-41-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-42-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-44-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-84-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-50-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-51-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-37-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-83-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-66-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-67-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-74-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/2744-81-0x00000000000F0000-0x0000000000172000-memory.dmp

Filesize
520KB

Download
memory/3056-1-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/3056-0-0x0000000001360000-0x00000000013EA000-memory.dmp

Filesize
552KB

Download
memory/3056-38-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/3056-2-0x0000000000CE0000-0x0000000000D20000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads