remcos | 83b57b6c1e7e55c33c6a5c5b751b864fa4c5cdb1e07ae394acb7c5b91d22e6c5

General

Target

ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe
Size

854KB
MD5

ecf8c8ad1ec6f053c438cbc9f666bef0
SHA1

262a2de7b04dc2e6edab9bf80120b55efea15c99
SHA256

83b57b6c1e7e55c33c6a5c5b751b864fa4c5cdb1e07ae394acb7c5b91d22e6c5
SHA512

ce363959049ea6b927cf3d2c09412eff956b0cfd81acd8f4a1b26afafff39d318e3a29f4b541b4d06b2b81390800c71b57848f6434eee466095f06dfa397b259
SSDEEP

24576:zfgEy1wcWDZiuG0WBGmp94f6mHhrI9tYGb3tu:zw1WDZiuG0WB3yfdhM3xpu

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

91.214.78.17:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-F2TGAV
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe

description pid process target process

PID 2548 set thread context of 2612 2548 ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe wab.exe

description	pid	process	target process
PID 2548 set thread context of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe

description	pid	process	target process
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 3020	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	svchost.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2612	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	wab.exe
PID 2548 wrote to memory of 2736	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	WerFault.exe
PID 2548 wrote to memory of 2736	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	WerFault.exe
PID 2548 wrote to memory of 2736	2548	ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ecf8c8ad1ec6f053c438cbc9f666bef0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
2⤵
PID:3020

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe"
2⤵
PID:2612

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2548 -s 648
2⤵
PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-44-0x000007FEF5D83000-0x000007FEF5D84000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download
memory/2548-2-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

Filesize
9.9MB

Download
memory/2548-3-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2548-4-0x0000000000300000-0x00000000003D2000-memory.dmp

Filesize
840KB

Download
memory/2548-0-0x000007FEF5D83000-0x000007FEF5D84000-memory.dmp

Filesize
4KB

Download
memory/2548-45-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

Filesize
9.9MB

Download
memory/2612-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2612-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-53-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2612-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3020-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3020-5-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3020-9-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3020-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3020-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3020-7-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3020-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3020-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads