remcos | d512aae6332400529ace4e7b466bf545c4031d3c54fe36d4fe88f322ff71c7c6

General

Target

Ofx RAD05001 40 03 013 2024 00450 00.exe
Size

1023.9MB
MD5

76d8531f558cf1e45387137a1b91670f
SHA1

82a4a9a3369c7b5610c38cf68cdee4c43f21d323
SHA256

bf20c21df71040b3cf3b9ad5ce6fb0d97fceccdb9e9d547a80d9f5abe46437ca
SHA512

4b14d8ca43790fc3680cde1094017fe81f9eec204b7f7c3c9bfe0e1694683bd6e0e3fd752bae04fb0f20f7fa3da0bfe3731549da1bf18132fdf6a9bf8beb7d3a
SSDEEP

12288:4GBgEAeHszumED9CS8RwvWV9fV8S4Y2QYFz43VxRW:hBgEApqmWmwE9fiBj8fRW

Score

10^/10

remcos jordan rat

Malware Config

Extracted

Family

remcos

Botnet

JORDAN

C2

amapola.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YTQPQ7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3856	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	csc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 2008	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	97
PID 2840 wrote to memory of 1436	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	98
PID 2840 wrote to memory of 1436	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	98
PID 2840 wrote to memory of 1436	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	98
PID 2840 wrote to memory of 4508	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	100
PID 2840 wrote to memory of 4508	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	100
PID 2840 wrote to memory of 4508	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	100
PID 4508 wrote to memory of 3856	4508	cmd.exe	102
PID 4508 wrote to memory of 3856	4508	cmd.exe	102
PID 4508 wrote to memory of 3856	4508	cmd.exe	102
PID 2840 wrote to memory of 2884	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	103
PID 2840 wrote to memory of 2884	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	103
PID 2840 wrote to memory of 2884	2840	Ofx RAD05001 40 03 013 2024 00450 00.exe	103

C:\Users\Admin\AppData\Local\Temp\Ofx RAD05001 40 03 013 2024 00450 00.exe
"C:\Users\Admin\AppData\Local\Temp\Ofx RAD05001 40 03 013 2024 00450 00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:1436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:3856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\Ofx RAD05001 40 03 013 2024 00450 00.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
1fdfdee2782bc8f0090364d9cfd55423

SHA1
5b14d5df73e2efc957c71fe14415ddd9bbad1806

SHA256
49126bc80a927667d0d392bc647fd0728e6174ef42a68c3176948da32802a0f8

SHA512
e5798c145012523bc0104fe7a2a7a23049116ab9ab0f5281528aded7cdf437d03e7864d436c40d2f1f5754dd47df9709e34f859f610cce1338e3d64a521f9d46

Download Submit
memory/2008-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-5-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-4-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-8-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-7-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-10-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2008-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2840-0-0x0000000000AD0000-0x0000000000B5A000-memory.dmp

Filesize
552KB

Download
memory/2840-1-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/2840-2-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/2840-3-0x0000000005A00000-0x0000000005FA4000-memory.dmp

Filesize
5.6MB

Download
memory/2840-18-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads