remcos | 866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309

General

Target

866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
Size

996KB
MD5

3112375e035766a604350754d20460dd
SHA1

6f8377e4b95fd9f5af3921616410b2c986dfb8ba
SHA256

866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309
SHA512

6a7186b4b76575a51374fadd1120163e47d0bb21d8dfc000893f91a57e7f3487f68338de651bb21a78cd8ef6e5581c2d6b2d7c5c7b0f188071a8f1f70d0b1258
SSDEEP

24576:wn698VVYl6Jic3uH34B+HH5U3F7+IYz8pLjG0:H9SBx3uX4Q5U3pnYO/G0

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

104.250.180.178:7902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Microsoft .exe
copy_folder
Microsoft
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Microsoft -QUCX7D
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe

description	pid	process	target process
PID 2700 set thread context of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe

pid	process
2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe

description pid process

Token: SeDebugPrivilege 2700 866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe

description	pid	process
Token: SeDebugPrivilege	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe

C:\Users\Admin\AppData\Local\Temp\866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
"C:\Users\Admin\AppData\Local\Temp\866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Local\Temp\866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
"C:\Users\Admin\AppData\Local\Temp\866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe"
2⤵
PID:4964

C:\Users\Admin\AppData\Local\Temp\866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
"C:\Users\Admin\AppData\Local\Temp\866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe"
2⤵
PID:444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/444-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2700-8-0x00000000047A0000-0x00000000047B0000-memory.dmp

Filesize
64KB

Download
memory/2700-15-0x0000000075330000-0x0000000075AE0000-memory.dmp

Filesize
7.7MB

Download
memory/2700-2-0x0000000005380000-0x0000000005924000-memory.dmp

Filesize
5.6MB

Download
memory/2700-0-0x000000007533E000-0x000000007533F000-memory.dmp

Filesize
4KB

Download
memory/2700-10-0x0000000007810000-0x00000000078AC000-memory.dmp

Filesize
624KB

Download
memory/2700-9-0x00000000063A0000-0x0000000006460000-memory.dmp

Filesize
768KB

Download
memory/2700-1-0x0000000000270000-0x000000000036C000-memory.dmp

Filesize
1008KB

Download
memory/2700-7-0x00000000061F0000-0x00000000061FC000-memory.dmp

Filesize
48KB

Download
memory/2700-6-0x0000000005F30000-0x0000000005F52000-memory.dmp

Filesize
136KB

Download
memory/2700-5-0x0000000075330000-0x0000000075AE0000-memory.dmp

Filesize
7.7MB

Download
memory/2700-4-0x0000000004D70000-0x0000000004D7A000-memory.dmp

Filesize
40KB

Download
memory/2700-3-0x0000000004DD0000-0x0000000004E62000-memory.dmp

Filesize
584KB

Download

description	pid	process	target process
PID 2700 wrote to memory of 4964	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 4964	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 4964	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe
PID 2700 wrote to memory of 444	2700	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe	866de3bdc1cc207c818212511641cdf5e6220f304619a26b5e9cb2d2b9c8a309.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads