remcos | edd45e1320b7fbbc8b7ce2907c5bade1e1cc0a92d940fa738b4fa8a0e52e37b7

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
edd45e1320b7fbbc8b7ce2907c5bade1e1cc0a92d940fa738b4fa8a0e52e37b7.exe
Size 545KB
Sample240604-s1e8bscc65
SHA256 edd45e1320b7fbbc8b7ce2907c5bade1e1cc0a92d940fa738b4fa8a0e52e37b7
MD5 becd8ce44a82d410cd395f4a7651869a
SHA1 1ea7970aa6e223d52f206a9a3d89d8747571b8ee
SHA512 08f4b3577b3e7ffb8fd4e94d95fbcb7ec284f2bf09b22ff0f6f350ebd55f2425498afe25109e1d219051f603d4101f256e2700f376289ed78394aa05e96bb44d
SSDEEP 12288:bxTefM3If+9vMy0uFnwtNSqYog6V8D2yQ/ucX9Q:bxa68y0uFnMxgmWQ2cXK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos windows rat

Malware Config

Extracted

Family

remcos

Botnet

windows

96.47.235.152:2024

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-CY2YU2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Program crash 28 IoCs

pid	pid_target	Process	procid_target
1748	664	WerFault.exe	80
4460	664	WerFault.exe	80
4164	664	WerFault.exe	80
808	664	WerFault.exe	80
4984	664	WerFault.exe	80
5064	664	WerFault.exe	80
4060	664	WerFault.exe	80
1020	664	WerFault.exe	80
4076	664	WerFault.exe	80
3904	664	WerFault.exe	80
2584	664	WerFault.exe	80
3528	664	WerFault.exe	80
4100	664	WerFault.exe	80
2384	664	WerFault.exe	80
4520	664	WerFault.exe	80
4836	664	WerFault.exe	80
4832	664	WerFault.exe	80
1472	664	WerFault.exe	80
3400	664	WerFault.exe	80
1924	664	WerFault.exe	80
4532	664	WerFault.exe	80
3988	664	WerFault.exe	80
1020	664	WerFault.exe	80
5004	664	WerFault.exe	80
3892	664	WerFault.exe	80
4332	664	WerFault.exe	80
3048	664	WerFault.exe	80
2168	664	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
664	edd45e1320b7fbbc8b7ce2907c5bade1e1cc0a92d940fa738b4fa8a0e52e37b7.exe

C:\Users\Admin\AppData\Local\Temp\edd45e1320b7fbbc8b7ce2907c5bade1e1cc0a92d940fa738b4fa8a0e52e37b7.exe
"C:\Users\Admin\AppData\Local\Temp\edd45e1320b7fbbc8b7ce2907c5bade1e1cc0a92d940fa738b4fa8a0e52e37b7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 684
  2⤵
  - Program crash
  PID:1748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 712
  2⤵
  - Program crash
  PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 728
  2⤵
  - Program crash
  PID:4164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 756
  2⤵
  - Program crash
  PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 776
  2⤵
  - Program crash
  PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 740
  2⤵
  - Program crash
  PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 768
  2⤵
  - Program crash
  PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 692
  2⤵
  - Program crash
  PID:1020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 804
  2⤵
  - Program crash
  PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 836
  2⤵
  - Program crash
  PID:3904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 856
  2⤵
  - Program crash
  PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 732
  2⤵
  - Program crash
  PID:3528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 988
  2⤵
  - Program crash
  PID:4100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1008
  2⤵
  - Program crash
  PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1008
  2⤵
  - Program crash
  PID:4520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1084
  2⤵
  - Program crash
  PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1036
  2⤵
  - Program crash
  PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1340
  2⤵
  - Program crash
  PID:1472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 740
  2⤵
  - Program crash
  PID:3400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1464
  2⤵
  - Program crash
  PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1060
  2⤵
  - Program crash
  PID:4532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1472
  2⤵
  - Program crash
  PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1060
  2⤵
  - Program crash
  PID:1020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1440
  2⤵
  - Program crash
  PID:5004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1296
  2⤵
  - Program crash
  PID:3892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 920
  2⤵
  - Program crash
  PID:4332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 1464
  2⤵
  - Program crash
  PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 984
  2⤵
  - Program crash
  PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 664 -ip 664
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 664 -ip 664
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 664 -ip 664
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 664 -ip 664
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 664 -ip 664
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 664 -ip 664
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 664 -ip 664
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 664 -ip 664
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 664 -ip 664
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 664 -ip 664
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 664 -ip 664
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 664 -ip 664
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 664 -ip 664
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 664 -ip 664
1⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 664 -ip 664
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 664 -ip 664
1⤵
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 664 -ip 664
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 664 -ip 664
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 664 -ip 664
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 664 -ip 664
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 664 -ip 664
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 664 -ip 664
1⤵
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 664 -ip 664
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 664 -ip 664
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 664 -ip 664
1⤵
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 664 -ip 664
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 664 -ip 664
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 664 -ip 664
1⤵
PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 130d75dc9de608ef0ff9a72f45c92a026894c494751f9ce297366a520e64dd79
MD5 e0283273985f7a5de490103b68d139e6
SHA1 ee36accec8b7e4fbc01b95c4c9a69a906e0e3264
SHA512 d04e987c40ed312dabe1747fee313ca0f34dc9d9d46435a76ac829bac7a20355d3e833f07a8a512bc1a0cbf99f8e719190b24e7541e3cbe6f0bd4d6e2c66f50f
MD5 SHA1 SHA512

Submit Download

memory/664-18-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-3-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/664-7-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-12-0x0000000000830000-0x00000000008AA000-memory.dmp

Download

memory/664-11-0x00000000008C0000-0x00000000009C0000-memory.dmp

Download

memory/664-10-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-13-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/664-2-0x0000000000830000-0x00000000008AA000-memory.dmp

Download

memory/664-1-0x00000000008C0000-0x00000000009C0000-memory.dmp

Download

memory/664-15-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-27-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-25-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-22-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-30-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-34-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-36-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-39-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-42-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-46-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

memory/664-48-0x0000000000400000-0x00000000006C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads