remcos | 909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768

General

Target

909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe
Size

864KB
MD5

1a0d7a2a1e9ef04c516c7ac650ba0593
SHA1

5539262df6253bb9958b115deb03147286e2e9f6
SHA256

909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768
SHA512

2e20945c03181fbad13be970dc32824d339686c6a63fe41cdc934dc7823c87890521260d18829c0c2a03f2a83b684dfe54e2a5edd0088036e2c18a41ba3f73c6
SSDEEP

12288:9RYME1O4s1ZQwyyUkb7Mb0ERfd31PS0aqqNNibhvFChjELzjAG+YFKxLJErKpfa:MrcZtUI7MQCF31PUnYvFClshCNEaa

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

91.214.78.17:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-MF7K1V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe

description	pid	process	target process
PID 1948 set thread context of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe

description pid process

Token: SeDebugPrivilege 1948 909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

2512 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe

pid	process
2512	iexplore.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe

description	pid	process	target process
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 1656	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	cmd.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2532	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	ngen.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2512	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2516	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2516	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2516	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe
PID 1948 wrote to memory of 2516	1948	909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe
"C:\Users\Admin\AppData\Local\Temp\909b4092841b4056937777a197673e86be281f43db661ee636ccd73744015768.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:1656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
2⤵
PID:2532

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2512

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
8b43788affa1ba3fc240f4a49f347f70

SHA1
ccda4f8a8e1140ee118dc0f7fad915d5921394a5

SHA256
1cbeb87f6157afcf197feb9bddf26ca72831db61e9db75754df07c8ed4015bc6

SHA512
f739cf9d721e72e008747f212e5f892d286b1c8d5c217096ec3508ab43d5119bf497751bc38b2e98ca77b7d8841c1074df04e6119b699e15bd2be73a48f88b44

Download Submit
memory/1656-9-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1656-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1656-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1656-7-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1656-5-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1656-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1656-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1656-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1948-2-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/1948-4-0x000000001AF90000-0x000000001B062000-memory.dmp

Filesize
840KB

Download
memory/1948-3-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/1948-0-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/1948-34-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/1948-1-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

Filesize
64KB

Download
memory/2512-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing