Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
18/05/2024, 22:54
General
- Target 78044e38f1aa6a5a7362ac521b38b85ec5bc18225cbb8758f8ff3f0059b0f73c.exe
- Size 5.0MB
- Sample240518-2vr5dacc9s
- SHA256 78044e38f1aa6a5a7362ac521b38b85ec5bc18225cbb8758f8ff3f0059b0f73c
Malware Config
Extracted
-
remcos
-
spacolombia
-
areaseguras.con-ip.com:2701
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
loggsd
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc12145501-WMWIXV
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78044e38f1aa6a5a7362ac521b38b85ec5bc18225cbb8758f8ff3f0059b0f73c.exe"C:\Users\Admin\AppData\Local\Temp\78044e38f1aa6a5a7362ac521b38b85ec5bc18225cbb8758f8ff3f0059b0f73c.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\78044e38f1aa6a5a7362ac521b38b85ec5bc18225cbb8758f8ff3f0059b0f73c.exe"C:\Users\Admin\AppData\Local\Temp\78044e38f1aa6a5a7362ac521b38b85ec5bc18225cbb8758f8ff3f0059b0f73c.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
memory/1432-4905-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1432-4923-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4940-30-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-36-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-20-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-28-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-48-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-58-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-66-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-64-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-62-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-60-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-54-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-52-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-50-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-56-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-46-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-44-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-42-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-38-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-32-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-0-0x00000000749CE000-0x00000000749CF000-memory.dmp
memory/4940-10-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-24-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-41-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-34-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-26-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-22-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-18-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-16-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-12-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-14-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-6-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-4-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-3-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-4890-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4940-4889-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4940-4891-0x0000000005CD0000-0x0000000005D6A000-memory.dmp
memory/4940-4892-0x0000000005D70000-0x0000000005DBC000-memory.dmp
memory/4940-4893-0x0000000007A70000-0x0000000008014000-memory.dmp
memory/4940-4894-0x0000000007330000-0x0000000007384000-memory.dmp
memory/4940-4904-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4940-8-0x0000000006F50000-0x00000000071A8000-memory.dmp
memory/4940-2-0x0000000006F50000-0x00000000071AE000-memory.dmp
memory/4940-1-0x0000000000E20000-0x0000000001330000-memory.dmp