remcos | 283fd9269a10ccbdff570c87ca0739b53f9b1cfb65309647bb6370ac3bddf5ec

General

Target

f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
Size

989KB
MD5

5d4a1543df1e7ee3ec6393b7f2e9435c
SHA1

f57d0fbb8a3c5f96486b87bfeb56c9ee140faca9
SHA256

f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e
SHA512

7e56907cc86e423bab6bc02661ca8ba7787ed5fe412a226a326a97ed115c3b9da03f2ef6ec603fcb6f2b561be31487ec252d337c68791079b0ffe85e03312e78
SSDEEP

12288:ppahc5Gs5eiBq7rdlsOkbSFRUx4rbFY4Qo/g7bmGhiqZr8JqkOMbpceiLz1dl:pZci87Hs5bRkQommGQKJWpBiZ

Score

10^/10

remcos admepc rat

Malware Config

Extracted

Family

remcos

Botnet

Admepc

C2

darkotemplar.sytes.net:1999

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
admepc.exe
copy_folder
Admepc
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
admepc
mouse_option
false
mutex
Rmc-SETMPC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe

description	pid	process	target process
PID 2156 set thread context of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe

pid process

2984 f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe

pid	process
2984	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe

description	pid	process	target process
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
PID 2156 wrote to memory of 2984	2156	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe	f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe

C:\Users\Admin\AppData\Local\Temp\f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
"C:\Users\Admin\AppData\Local\Temp\f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156

C:\Users\Admin\AppData\Local\Temp\f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe
"C:\Users\Admin\AppData\Local\Temp\f2fe3aa0d244d7f17610042ee41aaa3eff40b1a349b43f317ff92f6ec5b7608e.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\admepc\logs.dat
Filesize
144B

MD5
96a04dbcc36bcb85d3ecef8109e0185c

SHA1
180e966b55474cf93565a7ec9305f8c0d1d3737a

SHA256
3464f6ee8b7ed4eaf4f2b4894e02ac69bea71f1087aa1310dbf2b5f51a24e963

SHA512
c069e3d44657050908844deef4fe45dd55e49b550b782552c15bdf22e02a754265f49cf8ef5a981641bbba0af560a0243f73aaf1faf5a7a2a67cba9bc01ba623

Download Submit
memory/2156-0-0x00000000002F0000-0x00000000003EE000-memory.dmp

Filesize
1016KB

Download
memory/2156-1-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/2156-3-0x0000000004710000-0x00000000047BE000-memory.dmp

Filesize
696KB

Download
memory/2156-2-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2156-4-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/2156-20-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/2984-11-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-7-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-9-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-8-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-12-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-14-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-10-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-19-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-25-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-30-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-31-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-33-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-34-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download
memory/2984-5-0x0000000000130000-0x00000000001B2000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing