remcos | bf19328d703ff4ad6b67c9cd584147ed69ce2e82932350334f1705aad63316b4

General

Target

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe
Size

483KB
MD5

31b0f56a8bb3f5fcc3b8bfecb2684ce0
SHA1

ff505f7a5015510639153857f4377b42c02700c7
SHA256

bf19328d703ff4ad6b67c9cd584147ed69ce2e82932350334f1705aad63316b4
SHA512

187968c5c2b1dbd70d468b3917cff61bfaae21cff2ab14c8d41dfb77583aaf76af0637e46d0acdd1be8cd96fe380a5e1c256f1cc82e27c578b179c4b3f315650
SSDEEP

6144:gXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNy5Gv:gX7tPMK8ctGe4Dzl4h2QnuPs/Zs/cv

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

rxms.duckdns.org:57832

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
RmcTctTXerye8Yic-US5CLC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

description	pid	process	target process
PID 4584 set thread context of 4624	4584	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

pid	process
4584	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe
4584	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

pid process

4584 1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

4624 iexplore.exe

pid	process
4624	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe

description	pid	process	target process
PID 4584 wrote to memory of 4624	4584	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	iexplore.exe
PID 4584 wrote to memory of 4624	4584	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	iexplore.exe
PID 4584 wrote to memory of 4624	4584	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	iexplore.exe
PID 4584 wrote to memory of 4624	4584	1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4584

\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
2419cdf9e257b34b8f021929ab31fb20

SHA1
37d8f6cb76083292f611e4f42c37db6eade442d3

SHA256
52f38af681bc1baf3cfb5c06cd4e08e6a5088f2f806f7431b6a8b00f40bf15f0

SHA512
4b06b652fce10051cb6b196eb8fce3bd2fce75caa81c3f51ccfcdc1e455283d0efcfc8d9628cbeb128289246f43ffe3d7e3098629849355422dca929266a23b4

Download Submit
memory/4624-15-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-41-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-11-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-6-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-7-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-8-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-9-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-10-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-4-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-2-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-20-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-16-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-1-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-24-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-25-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-32-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-33-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-40-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download
memory/4624-0-0x0000000000D40000-0x0000000000DC2000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads