remcos | bf19328d703ff4ad6b67c9cd584147ed69ce2e82932350334f1705aad63316b4

General

Target

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe
Size

483KB
MD5

31b0f56a8bb3f5fcc3b8bfecb2684ce0
SHA1

ff505f7a5015510639153857f4377b42c02700c7
SHA256

bf19328d703ff4ad6b67c9cd584147ed69ce2e82932350334f1705aad63316b4
SHA512

187968c5c2b1dbd70d468b3917cff61bfaae21cff2ab14c8d41dfb77583aaf76af0637e46d0acdd1be8cd96fe380a5e1c256f1cc82e27c578b179c4b3f315650
SSDEEP

6144:gXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNy5Gv:gX7tPMK8ctGe4Dzl4h2QnuPs/Zs/cv

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

rxms.duckdns.org:57832

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
RmcTctTXerye8Yic-US5CLC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

description	pid	process	target process
PID 2240 set thread context of 3012	2240	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

pid process

2240 1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

pid process

2240 1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

3012 svchost.exe

pid	process
2240	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

pid	process
2240	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

pid	process
3012	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

description	pid	process	target process
PID 2240 wrote to memory of 3012	2240	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	svchost.exe
PID 2240 wrote to memory of 3012	2240	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	svchost.exe
PID 2240 wrote to memory of 3012	2240	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	svchost.exe
PID 2240 wrote to memory of 3012	2240	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	svchost.exe
PID 2240 wrote to memory of 3012	2240	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
2a1efddc929c9fd966b0c9854872b89b

SHA1
7d1e29e1d181f56ef679879c2743d6f8821746d0

SHA256
0b4b6e516eecdd94f0fcea2b8bfd669a71301ebc63ed6410aaf234c1d2102550

SHA512
4d5b1638b8933b2b2ebff8f9f92f24115c8db4d7e3e5724f05a5b7d470877a2bf294eb253105ffda716934894e5acbdadfff10730fcaf5ab5153c1e37c8f8175

Download Submit
memory/3012-16-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-41-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-5-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-7-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-8-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-9-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-10-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-17-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-50-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-4-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-11-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-21-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-2-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-25-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-26-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-33-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-34-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3012-49-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download
memory/3012-12-0x0000000000150000-0x00000000001D2000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing