remcos | 8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe
Size 1.1MB
Sample240509-q5s9msff72
SHA256 8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74
MD5 e0b3f01e85fd6e4c059d1761ef8cc64b
SHA1 7cf9f90a0ed61705ee6f7089811744f0250231ff
SHA512 e4fbf06cce26c6046e7a039708fa8597f5f4d97e90f9274e19bedb8216d054f42b75102d923b7e9431159a28e6262f81d95d52e63a720a9109d2dada3c187344
SSDEEP 24576:NFAGeSZOaI/0bKa4vQ4aTgTnnqx+NQ/kgKIKv:NOGeSEIn8Q0BhgKX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos papi rat

Malware Config

Extracted

Family

remcos

Botnet

PAPI

64.188.18.137:1604

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-RLYAO5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1144 set thread context of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4960	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	85
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 4880	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	88
PID 1144 wrote to memory of 3700	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	89
PID 1144 wrote to memory of 3700	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	89
PID 1144 wrote to memory of 3700	1144	8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe	89

C:\Users\Admin\AppData\Local\Temp\8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe
"C:\Users\Admin\AppData\Local\Temp\8c0c08ab68b43dc62083f04eaf80e20c553d90b1e225523878c6685764a18e74.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:4880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:3700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-10-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp

Download

memory/1144-0-0x000002209ECC0000-0x000002209ED00000-memory.dmp

Download

memory/1144-2-0x00000220A0960000-0x00000220A0A34000-memory.dmp

Download

memory/1144-3-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp

Download

memory/1144-1-0x00007FF83DF33000-0x00007FF83DF35000-memory.dmp

Download

memory/4880-11-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-15-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-7-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-9-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-6-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-5-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-12-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-13-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-14-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-4-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-16-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-17-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-18-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-19-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-20-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-21-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-22-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4880-23-0x0000000000400000-0x0000000000482000-memory.dmp

Download