remcos | 4964e7f096d6b3fb575040c01238d88aa01204abd4411c9515b500299b40b830

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe
Size

997KB
MD5

ccc056c533979eacb9089e27c5b24518
SHA1

d85d5e3540711d86bcd798f74b6fd68deb100a8e
SHA256

38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f
SHA512

e2c8181bbddf2f7e391d391e0e253beb0472950ef58e371a699b4b24f471c287f14146530bd45e79e0f6d78eada493c522e7e1c55eb207ef5c1735eca249cae2
SSDEEP

24576:9aj8qIR12+0LufeamU7DoLyo5yViQkZmSXwVtJ:RkLUnno5xQkQTV

Score

10^/10

remcos john smith rat

Malware Config

Extracted

Family

remcos

Botnet

JOHN SMITH

192.210.201.57:62289

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GIZGNL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3048	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28
PID 3020 wrote to memory of 3048	3020	38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe	28

C:\Users\Admin\AppData\Local\Temp\38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe
"C:\Users\Admin\AppData\Local\Temp\38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe
  "C:\Users\Admin\AppData\Local\Temp\38d45a0e0f376be174d788c93424ef4724daad94ce4139beba1868a36d8ad47f.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
c08e3cff91db129c826d2aca219246ed

SHA1
305b70f914d71a5538b218e520bf4054797c4192

SHA256
d78e3f2eab4dd70bad6d1a0ef6fd55f41ef1e83de3c6f412d8c2764f0254e2df

SHA512
0b649175960b2a9c3cb683b0e6c64bf554c8e44f6c19289d8a1e419d5785a99efb73225e106cd910afd86437489cb49ba7c3d06427f43d2274e8a4f4bf15fc3b

Download Submit
memory/3020-18-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/3020-1-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/3020-2-0x0000000000C80000-0x0000000000CC0000-memory.dmp

Filesize
256KB

Download
memory/3020-3-0x0000000000570000-0x0000000000582000-memory.dmp

Filesize
72KB

Download
memory/3020-4-0x0000000000610000-0x000000000061C000-memory.dmp

Filesize
48KB

Download
memory/3020-5-0x0000000005360000-0x0000000005420000-memory.dmp

Filesize
768KB

Download
memory/3020-0-0x00000000011D0000-0x00000000012D0000-memory.dmp

Filesize
1024KB

Download
memory/3048-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-9-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-8-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-7-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-10-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-53-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-66-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-76-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-79-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-81-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-87-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3048-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download