Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
19-03-2024 18:49
General
-
Target
056cdf4a67164ded09385efec0912ccbb1c365c151d01b0a3633de1c4d410a18.exe
-
Size
469KB
-
MD5
29b622980bc32771d8cac127961b0ba5
-
SHA1
895a13abd7ef4f8e0ea9cc1526350eccf1934b27
-
SHA256
056cdf4a67164ded09385efec0912ccbb1c365c151d01b0a3633de1c4d410a18
-
SHA512
7410b6413f4177d44ad3b55652ca57e3d622c806e423286a3ae90dd8026edb3552d304fde3c2b82ee0b8ef3dc4ba0e4a185d0d03be96d9fa5f8be7347592db95
-
SSDEEP
12288:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSvn9:WiLJbpI7I2WhQqZ7v9
Malware Config
Extracted
remcos
RemoteHost
185.158.251.159:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TKL5S3
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\056cdf4a67164ded09385efec0912ccbb1c365c151d01b0a3633de1c4d410a18.exe"C:\Users\Admin\AppData\Local\Temp\056cdf4a67164ded09385efec0912ccbb1c365c151d01b0a3633de1c4d410a18.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5575390a7fb3669802f265ab1f64b4c52
SHA1afae4598a2c77471fed693ba08d94fe5b7e13ac4
SHA2569655fcfbb5c6752bb60f35240aa06056eaced6b6053394f5f5d88abbef2c846f
SHA5123bc5db7fda879413038c85f6f1d9f24c3277aee48a6b7de34fa411acf9d3d71a20912873dc3f252ed5e3c0940011ce09d85ab1ec2f19165fa9a5e26c87e28bd8
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB