remcos | ac86c915f906f5f27b59d28eb0b9d5e8398619acf3ec95598dfe82b8de3d0ea3

Analysis

max time kernel
190s
max time network
204s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PROCESO DEMANDA. REF; 3456980012-770-2024..exe
Size

1023.9MB
MD5

76d8531f558cf1e45387137a1b91670f
SHA1

82a4a9a3369c7b5610c38cf68cdee4c43f21d323
SHA256

bf20c21df71040b3cf3b9ad5ce6fb0d97fceccdb9e9d547a80d9f5abe46437ca
SHA512

4b14d8ca43790fc3680cde1094017fe81f9eec204b7f7c3c9bfe0e1694683bd6e0e3fd752bae04fb0f20f7fa3da0bfe3731549da1bf18132fdf6a9bf8beb7d3a
SSDEEP

12288:4GBgEAeHszumED9CS8RwvWV9fV8S4Y2QYFz43VxRW:hBgEApqmWmwE9fiBj8fRW

Score

10^/10

remcos jordan rat

Malware Config

Extracted

Family

remcos

Botnet

JORDAN

amapola.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YTQPQ7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2448	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2500	csc.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2500	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 1656 wrote to memory of 2572	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	29
PID 1656 wrote to memory of 2572	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	29
PID 1656 wrote to memory of 2572	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	29
PID 1656 wrote to memory of 2572	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	29
PID 1656 wrote to memory of 2632	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	32
PID 1656 wrote to memory of 2632	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	32
PID 1656 wrote to memory of 2632	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	32
PID 1656 wrote to memory of 2632	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	32
PID 2632 wrote to memory of 2448	2632	cmd.exe	35
PID 2632 wrote to memory of 2448	2632	cmd.exe	35
PID 2632 wrote to memory of 2448	2632	cmd.exe	35
PID 2632 wrote to memory of 2448	2632	cmd.exe	35
PID 1656 wrote to memory of 2492	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	36
PID 1656 wrote to memory of 2492	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	36
PID 1656 wrote to memory of 2492	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	36
PID 1656 wrote to memory of 2492	1656	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	36

C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe
"C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
62e97a83f0324d8d6d22822b04a96e73

SHA1
3408efe019aa8ca00327b1763a29ec9a9cc06b41

SHA256
4abbfa6ed82b16c528c3c7dff0ece3c5e37f538b695ef698d0c27c73d2c872b7

SHA512
e78873d7d527da1d7455fd759ed7d69226e27685604d5393f97777d690ecc7a56ef734c68d2785613e6fb0b715f128cf901706a2cd4566cc400e8c0491fbf50f

Download Submit
memory/1656-0-0x0000000001310000-0x000000000139A000-memory.dmp

Filesize
552KB

Download
memory/1656-1-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/1656-2-0x0000000001290000-0x00000000012D0000-memory.dmp

Filesize
256KB

Download
memory/1656-33-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/2500-30-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-34-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-8-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-9-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-10-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-12-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-14-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2500-15-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-20-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-25-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-26-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-28-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-29-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-7-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-5-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-6-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-35-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-36-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-37-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-38-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-42-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-45-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-46-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-3-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-53-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-54-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-61-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-69-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-70-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-77-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2500-78-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads