remcos | ac86c915f906f5f27b59d28eb0b9d5e8398619acf3ec95598dfe82b8de3d0ea3

Analysis

max time kernel
203s
max time network
196s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PROCESO DEMANDA. REF; 3456980012-770-2024..exe
Size

1023.9MB
MD5

76d8531f558cf1e45387137a1b91670f
SHA1

82a4a9a3369c7b5610c38cf68cdee4c43f21d323
SHA256

bf20c21df71040b3cf3b9ad5ce6fb0d97fceccdb9e9d547a80d9f5abe46437ca
SHA512

4b14d8ca43790fc3680cde1094017fe81f9eec204b7f7c3c9bfe0e1694683bd6e0e3fd752bae04fb0f20f7fa3da0bfe3731549da1bf18132fdf6a9bf8beb7d3a
SSDEEP

12288:4GBgEAeHszumED9CS8RwvWV9fV8S4Y2QYFz43VxRW:hBgEApqmWmwE9fiBj8fRW

Score

10^/10

remcos jordan rat

Malware Config

Extracted

Family

remcos

Botnet

JORDAN

amapola.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YTQPQ7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2572	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2664	csc.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2664	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	28
PID 2548 wrote to memory of 2856	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	29
PID 2548 wrote to memory of 2856	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	29
PID 2548 wrote to memory of 2856	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	29
PID 2548 wrote to memory of 2856	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	29
PID 2548 wrote to memory of 2836	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	31
PID 2548 wrote to memory of 2836	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	31
PID 2548 wrote to memory of 2836	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	31
PID 2548 wrote to memory of 2836	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	31
PID 2836 wrote to memory of 2572	2836	cmd.exe	33
PID 2836 wrote to memory of 2572	2836	cmd.exe	33
PID 2836 wrote to memory of 2572	2836	cmd.exe	33
PID 2836 wrote to memory of 2572	2836	cmd.exe	33
PID 2548 wrote to memory of 2524	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	35
PID 2548 wrote to memory of 2524	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	35
PID 2548 wrote to memory of 2524	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	35
PID 2548 wrote to memory of 2524	2548	PROCESO DEMANDA. REF; 3456980012-770-2024..exe	35

C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe
"C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:2856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:2572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\PROCESO DEMANDA. REF; 3456980012-770-2024..exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
5d6005fbd19bb97a96585a5e2f550ed9

SHA1
1dc1de2ae0d782b90c47941513e246fe1bc477df

SHA256
be82ac26a66b599de1e54e611f0bdfff0ef523c898bf98260125f7c0ea66c6e3

SHA512
ec2e144a2236a04663d99949b72ff61bffe259e1ce9af9777605cba2e1e39b4a1ce8b869cc10853b3e1eb616df518c562ad523909ff199bd027aef5e84265b94

Download Submit
memory/2548-0-0x0000000001380000-0x000000000140A000-memory.dmp

Filesize
552KB

Download
memory/2548-1-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-2-0x0000000000E00000-0x0000000000E40000-memory.dmp

Filesize
256KB

Download
memory/2548-44-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-38-0x0000000000E00000-0x0000000000E40000-memory.dmp

Filesize
256KB

Download
memory/2548-37-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-29-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-34-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-10-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-11-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-14-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-19-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-24-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-25-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-28-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-27-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-8-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-30-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-31-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-32-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-9-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-35-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-36-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-7-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-6-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-39-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-40-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-5-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-3-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-50-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-51-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-58-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-59-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-66-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-67-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/2664-74-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads