remcos | 5a119b0ed93110e0db2b42d4482b90768aa774483e9fdbf574470d3f5e003543

Analysis

max time kernel
297s
max time network
285s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
04/06/2024, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO240604.exe
Size

548KB
MD5

5646475fdcb96f5b0ea773df43bfc19c
SHA1

6b92bbe551a8da12ac1326faac3685f19f39248e
SHA256

5a119b0ed93110e0db2b42d4482b90768aa774483e9fdbf574470d3f5e003543
SHA512

316918d73f6c4b30b090f97f7fed3686398ffbe5485b8cfefae7847b4f1629093d7723887226adefa203b44920da471b9959dbb3097605f999da06c8e2b311af
SSDEEP

6144:xW04Td9bBsECWz2L3Xcc3FxEEpkONVvQgADYsEye2NJ/4XSiW+mzERY6DfkH1WT/:xOTd9bSECE2zjPpfvXsxJ/wWJzYkg

Score

10^/10

remcos windows rat

Malware Config

Extracted

Family

remcos

Botnet

windows

96.47.235.152:2024

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-CY2YU2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Program crash 36 IoCs

pid	pid_target	Process	procid_target
2364	4988	WerFault.exe	77
2684	4988	WerFault.exe	77
1268	4988	WerFault.exe	77
3812	4988	WerFault.exe	77
4884	4988	WerFault.exe	77
4376	4988	WerFault.exe	77
3968	4988	WerFault.exe	77
1908	4988	WerFault.exe	77
2892	4988	WerFault.exe	77
2356	4988	WerFault.exe	77
3148	4988	WerFault.exe	77
972	4988	WerFault.exe	77
3748	4988	WerFault.exe	77
2588	4988	WerFault.exe	77
1692	4988	WerFault.exe	77
2748	4988	WerFault.exe	77
1656	4988	WerFault.exe	77
2312	4988	WerFault.exe	77
1368	4988	WerFault.exe	77
708	4988	WerFault.exe	77
4848	4988	WerFault.exe	77
5076	4988	WerFault.exe	77
2700	4988	WerFault.exe	77
2264	4988	WerFault.exe	77
776	4988	WerFault.exe	77
4464	4988	WerFault.exe	77
2008	4988	WerFault.exe	77
788	4988	WerFault.exe	77
2272	4988	WerFault.exe	77
3120	4988	WerFault.exe	77
840	4988	WerFault.exe	77
2600	4988	WerFault.exe	77
3988	4988	WerFault.exe	77
5016	4988	WerFault.exe	77
1976	4988	WerFault.exe	77
4912	4988	WerFault.exe	77

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4988	PO240604.exe

C:\Users\Admin\AppData\Local\Temp\PO240604.exe
"C:\Users\Admin\AppData\Local\Temp\PO240604.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 720
  2⤵
  - Program crash
  PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 752
  2⤵
  - Program crash
  PID:2684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 788
  2⤵
  - Program crash
  PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 796
  2⤵
  - Program crash
  PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 756
  2⤵
  - Program crash
  PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 820
  2⤵
  - Program crash
  PID:4376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 756
  2⤵
  - Program crash
  PID:3968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 864
  2⤵
  - Program crash
  PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 780
  2⤵
  - Program crash
  PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1032
  2⤵
  - Program crash
  PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1072
  2⤵
  - Program crash
  PID:3148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1096
  2⤵
  - Program crash
  PID:972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1188
  2⤵
  - Program crash
  PID:3748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1216
  2⤵
  - Program crash
  PID:2588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 876
  2⤵
  - Program crash
  PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 792
  2⤵
  - Program crash
  PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1396
  2⤵
  - Program crash
  PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1400
  2⤵
  - Program crash
  PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1436
  2⤵
  - Program crash
  PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1220
  2⤵
  - Program crash
  PID:708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 792
  2⤵
  - Program crash
  PID:4848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 756
  2⤵
  - Program crash
  PID:5076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1400
  2⤵
  - Program crash
  PID:2700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1040
  2⤵
  - Program crash
  PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1552
  2⤵
  - Program crash
  PID:776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1592
  2⤵
  - Program crash
  PID:4464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1044
  2⤵
  - Program crash
  PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1580
  2⤵
  - Program crash
  PID:788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1548
  2⤵
  - Program crash
  PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1596
  2⤵
  - Program crash
  PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1556
  2⤵
  - Program crash
  PID:840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1396
  2⤵
  - Program crash
  PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1548
  2⤵
  - Program crash
  PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 852
  2⤵
  - Program crash
  PID:5016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1588
  2⤵
  - Program crash
  PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1604
  2⤵
  - Program crash
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4988 -ip 4988
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4988 -ip 4988
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4988 -ip 4988
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4988 -ip 4988
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4988 -ip 4988
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4988 -ip 4988
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4988 -ip 4988
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4988 -ip 4988
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4988 -ip 4988
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4988 -ip 4988
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4988 -ip 4988
1⤵
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4988 -ip 4988
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4988 -ip 4988
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4988 -ip 4988
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4988 -ip 4988
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4988 -ip 4988
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4988 -ip 4988
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4988 -ip 4988
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4988 -ip 4988
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4988 -ip 4988
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4988 -ip 4988
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4988 -ip 4988
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4988 -ip 4988
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4988 -ip 4988
1⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4988 -ip 4988
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4988 -ip 4988
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4988 -ip 4988
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4988 -ip 4988
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4988 -ip 4988
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4988 -ip 4988
1⤵
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4988 -ip 4988
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4988 -ip 4988
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4988 -ip 4988
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4988 -ip 4988
1⤵
PID:248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4988 -ip 4988
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4988 -ip 4988
1⤵
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
06e059e8347a7a7fb10e568b8019d178

SHA1
ccd5925299c18b0b525a2a9eb0a53e75848d2b82

SHA256
1ff4834e1dc4eed336316e302772dde206bf1681f2e7dda662ed7f88fcf0ec4e

SHA512
a97c41991c4aa819ede5fdf02cefd99adbd56ab9b92b3da37001c607854d73df62660eaca224479426a25a1898311668a53a1721a3b83576dabd0444a27de13d

Download Submit
memory/4988-43-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-2-0x00000000023D0000-0x000000000244A000-memory.dmp

Filesize
488KB

Download
memory/4988-7-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-9-0x0000000000850000-0x0000000000950000-memory.dmp

Filesize
1024KB

Download
memory/4988-12-0x00000000023D0000-0x000000000244A000-memory.dmp

Filesize
488KB

Download
memory/4988-11-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-1-0x0000000000850000-0x0000000000950000-memory.dmp

Filesize
1024KB

Download
memory/4988-15-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-18-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-22-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-25-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-27-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-30-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-34-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-37-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-3-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-39-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-46-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-48-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-51-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-55-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-58-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-60-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-63-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-67-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-70-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-72-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-75-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-79-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-81-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-84-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-87-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-91-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download
memory/4988-93-0x0000000000400000-0x00000000006C2000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads