Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 19:23
Static task
static1
Behavioral task
behavioral1
Sample
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe
Resource
win10v2004-20240508-en
General
-
Target
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe
-
Size
975KB
-
MD5
6bc3017aa0b572802c23e8fad4c7a612
-
SHA1
262fb0d7951854d4ba58ad2a38480fb0bbe4f6d1
-
SHA256
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5
-
SHA512
86c6dd6d2786d01990d86b4b69d624aa373f441e4b25f6730071a5336eb32939874e8c9dd445330dfa33a5598c23c7427b6a741ecdc178678507fcab0a1b1354
-
SSDEEP
24576:8LZq8lDaXLp5C7UMUoloIG8h3IP8trNwNoZ:8oUDaXLnC7Ia68FCO
Malware Config
Extracted
remcos
RemoteHost
46.183.223.69:13452
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-UJROWN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 2696 remcos.exe 2584 remcos.exe -
Loads dropped DLL 1 IoCs
Processes:
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exepid process 2404 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exeremcos.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exeremcos.exedescription pid process target process PID 1044 set thread context of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 2696 set thread context of 2584 2696 remcos.exe remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 2584 remcos.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exeremcos.exedescription pid process target process PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 1044 wrote to memory of 2404 1044 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 2404 wrote to memory of 2696 2404 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe remcos.exe PID 2404 wrote to memory of 2696 2404 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe remcos.exe PID 2404 wrote to memory of 2696 2404 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe remcos.exe PID 2404 wrote to memory of 2696 2404 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe PID 2696 wrote to memory of 2584 2696 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe"C:\Users\Admin\AppData\Local\Temp\062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe"C:\Users\Admin\AppData\Local\Temp\062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Remcos\logs.datFilesize
144B
MD5daab2a43008f16c49048e5c6319ef5d0
SHA11baaced228b03e0b976fed98fb11b5dbbb78a0e1
SHA25628d90c39bc8b678a6641bf15d33aba8c9cb8b0513c34a77ba787729e7f4ce047
SHA512abe4c28a155d8a326865cdecde581a08cdb6d5996ce9620f33e23bcf2e2388cb531b1de287591d5e93a990a69261b3031b4548e36eb4cf4d02037a596aaa434f
-
\ProgramData\Remcos\remcos.exeFilesize
975KB
MD56bc3017aa0b572802c23e8fad4c7a612
SHA1262fb0d7951854d4ba58ad2a38480fb0bbe4f6d1
SHA256062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5
SHA51286c6dd6d2786d01990d86b4b69d624aa373f441e4b25f6730071a5336eb32939874e8c9dd445330dfa33a5598c23c7427b6a741ecdc178678507fcab0a1b1354
-
memory/1044-1-0x0000000001210000-0x000000000130A000-memory.dmpFilesize
1000KB
-
memory/1044-2-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB
-
memory/1044-3-0x0000000005910000-0x0000000005A0A000-memory.dmpFilesize
1000KB
-
memory/1044-4-0x00000000004D0000-0x00000000004F2000-memory.dmpFilesize
136KB
-
memory/1044-5-0x00000000004F0000-0x00000000004FC000-memory.dmpFilesize
48KB
-
memory/1044-6-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/1044-7-0x0000000005E80000-0x0000000005F40000-memory.dmpFilesize
768KB
-
memory/1044-0-0x00000000741CE000-0x00000000741CF000-memory.dmpFilesize
4KB
-
memory/1044-28-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB
-
memory/2404-20-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2404-16-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2404-15-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2404-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2404-14-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2404-13-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2404-12-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2404-11-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2404-22-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2404-8-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2404-10-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-64-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-65-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-58-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-57-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-54-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-53-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2584-91-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-89-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-84-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-83-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-70-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-71-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-77-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-78-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2696-31-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB
-
memory/2696-32-0x0000000000E50000-0x0000000000F4A000-memory.dmpFilesize
1000KB
-
memory/2696-33-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB
-
memory/2696-59-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB