remcos | ac86c915f906f5f27b59d28eb0b9d5e8398619acf3ec95598dfe82b8de3d0ea3

General

Target

PROCESO DEMANDA. REF; 3456980012-770-2024..exe
Size

1023.9MB
MD5

76d8531f558cf1e45387137a1b91670f
SHA1

82a4a9a3369c7b5610c38cf68cdee4c43f21d323
SHA256

bf20c21df71040b3cf3b9ad5ce6fb0d97fceccdb9e9d547a80d9f5abe46437ca
SHA512

4b14d8ca43790fc3680cde1094017fe81f9eec204b7f7c3c9bfe0e1694683bd6e0e3fd752bae04fb0f20f7fa3da0bfe3731549da1bf18132fdf6a9bf8beb7d3a
SSDEEP

12288:4GBgEAeHszumED9CS8RwvWV9fV8S4Y2QYFz43VxRW:hBgEApqmWmwE9fiBj8fRW

Score

10^/10

remcos jordan rat

Malware Config

Extracted

Family

remcos

Botnet

JORDAN

C2

amapola.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YTQPQ7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3356	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	csc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 2172	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	107
PID 2824 wrote to memory of 5088	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	108
PID 2824 wrote to memory of 5088	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	108
PID 2824 wrote to memory of 5088	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	108
PID 2824 wrote to memory of 4536	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	110
PID 2824 wrote to memory of 4536	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	110
PID 2824 wrote to memory of 4536	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	110
PID 4536 wrote to memory of 3356	4536	cmd.exe	112
PID 4536 wrote to memory of 3356	4536	cmd.exe	112
PID 4536 wrote to memory of 3356	4536	cmd.exe	112
PID 2824 wrote to memory of 4064	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	113
PID 2824 wrote to memory of 4064	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	113
PID 2824 wrote to memory of 4064	2824	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	113

C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe
"C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:5088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:3356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
67d8178fc68b8356041e3b5104474b7e

SHA1
dc6e89eceab7cae8996c8e9936b777323ba14afb

SHA256
57104be093ae2fa27c5347faeccf86a7cc9b9067b9798197ef78418142f2425f

SHA512
df0fc3b298a1156339c3efa8e88d6e9d504006803bc78ce76484a31137ab8dd0b3e07583f26227b688910805776df1d9378f4cd4aaf28d78beeaec08c1af7a4e

Download Submit
memory/2172-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-4-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-5-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-7-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-8-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-10-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2172-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2824-1-0x0000000000CB0000-0x0000000000D3A000-memory.dmp

Filesize
552KB

Download
memory/2824-20-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/2824-2-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/2824-0-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/2824-3-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads