remcos | 37c07fe1f282439787db1d3eb77ded8c635ea9e73960230c126d889322e08fee

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
202400131.exe
Size 542KB
Sample240604-llgdhscg68
SHA256 37c07fe1f282439787db1d3eb77ded8c635ea9e73960230c126d889322e08fee
MD5 fdcf6f5fcb9c38b56da45f617a48c209
SHA1 91dce23e917a6641958a1ce475cd167a6c8ef9d2
SHA512 998a71a360291144d05de266c8b86766767d9c218bc87190da1ea96434d85c75d6adfa3442255cf32f9007e8d77f51ffc9f8a17ab8e53ed61298a675f43f77b0
SSDEEP 6144:JFLHZGUkKUedkxe3L684d83LRRwmzzDWN+u2jHyXdg/hXvCQahL2zgC02jHG5N7F:XDZG81degL6mtRvnLj/hKXSjrYNAmSK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos windows rat

Malware Config

Extracted

Family

remcos

Botnet

windows

96.47.235.152:2024

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-CY2YU2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Program crash 26 IoCs

pid	pid_target	Process	procid_target
1252	224	WerFault.exe	82
1028	224	WerFault.exe	82
4956	224	WerFault.exe	82
3524	224	WerFault.exe	82
2016	224	WerFault.exe	82
1208	224	WerFault.exe	82
5028	224	WerFault.exe	82
2104	224	WerFault.exe	82
4788	224	WerFault.exe	82
2864	224	WerFault.exe	82
3436	224	WerFault.exe	82
2984	224	WerFault.exe	82
4180	224	WerFault.exe	82
996	224	WerFault.exe	82
4212	224	WerFault.exe	82
2016	224	WerFault.exe	82
780	224	WerFault.exe	82
5064	224	WerFault.exe	82
2764	224	WerFault.exe	82
5012	224	WerFault.exe	82
872	224	WerFault.exe	82
4744	224	WerFault.exe	82
3656	224	WerFault.exe	82
3508	224	WerFault.exe	82
3320	224	WerFault.exe	82
4692	224	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
224	202400131.exe

C:\Users\Admin\AppData\Local\Temp\202400131.exe
"C:\Users\Admin\AppData\Local\Temp\202400131.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 620
  2⤵
  - Program crash
  PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 628
  2⤵
  - Program crash
  PID:1028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 624
  2⤵
  - Program crash
  PID:4956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 760
  2⤵
  - Program crash
  PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 760
  2⤵
  - Program crash
  PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 700
  2⤵
  - Program crash
  PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 812
  2⤵
  - Program crash
  PID:5028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 828
  2⤵
  - Program crash
  PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 980
  2⤵
  - Program crash
  PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1000
  2⤵
  - Program crash
  PID:2864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1036
  2⤵
  - Program crash
  PID:3436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1016
  2⤵
  - Program crash
  PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1048
  2⤵
  - Program crash
  PID:4180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1324
  2⤵
  - Program crash
  PID:996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 780
  2⤵
  - Program crash
  PID:4212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 808
  2⤵
  - Program crash
  PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1060
  2⤵
  - Program crash
  PID:780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1484
  2⤵
  - Program crash
  PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1516
  2⤵
  - Program crash
  PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1284
  2⤵
  - Program crash
  PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1504
  2⤵
  - Program crash
  PID:872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1520
  2⤵
  - Program crash
  PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 800
  2⤵
  - Program crash
  PID:3656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 976
  2⤵
  - Program crash
  PID:3508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 984
  2⤵
  - Program crash
  PID:3320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 1500
  2⤵
  - Program crash
  PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 224 -ip 224
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 224 -ip 224
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 224 -ip 224
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 224 -ip 224
1⤵
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 224 -ip 224
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 224 -ip 224
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 224 -ip 224
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 224 -ip 224
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 224 -ip 224
1⤵
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 224 -ip 224
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 224 -ip 224
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 224 -ip 224
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 224 -ip 224
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 224 -ip 224
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 224 -ip 224
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 224 -ip 224
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 224 -ip 224
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 224 -ip 224
1⤵
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 224 -ip 224
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 224 -ip 224
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 224 -ip 224
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 224 -ip 224
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 224 -ip 224
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 224 -ip 224
1⤵
PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 224 -ip 224
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 224 -ip 224
1⤵
PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 205901842ae60442d964c469502167e2372d90020c2e9238cbd4938d67f22e01
MD5 9439b9c6c9887b5e926989b8f3141fca
SHA1 70de1ca4e863c00406bfccb8a534968706b39f7a
SHA512 f71ca0daea4d3767276c1545ad3f21d80d5c2ca88fee86bbe7962bc1dc276e26e613d4c638aa64b5f0a1a027a4b9317a8620b3ade100af80b7942e1c1c72b2d1
MD5 SHA1 SHA512

Submit Download

memory/224-18-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-3-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/224-7-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-12-0x0000000001CB0000-0x0000000001D2A000-memory.dmp

Download

memory/224-11-0x0000000001D40000-0x0000000001E40000-memory.dmp

Download

memory/224-10-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-13-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/224-2-0x0000000001CB0000-0x0000000001D2A000-memory.dmp

Download

memory/224-1-0x0000000001D40000-0x0000000001E40000-memory.dmp

Download

memory/224-15-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-27-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-25-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-22-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-30-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-34-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-36-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-39-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-43-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-46-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

memory/224-48-0x0000000000400000-0x0000000001C03000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads