remcos | 28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe
Size

856KB
MD5

e24419df6c7ac3cbfd80f7a8268ab759
SHA1

0b40e02c810f89cd4f14b29261eb4a720b15e69b
SHA256

28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793
SHA512

9b1c2a40a3e92ed34b1866df59f37561e81df5573ea2f3aec1b79c6b78d919aedf11c6a9295f72d2619a07763590180660e147b1c6754996a718684efeef60f9
SSDEEP

24576:0XYHRTim+Nq125N+Zr+7SLptrw6A+7ooNbVOqQ98y5/:7pim+8k5DSLbrwsxU98y5/

Score

10^/10

remcos pupip rat

Malware Config

Extracted

Family

remcos

Botnet

PUPIP

zakriexports.com:1988

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
PUBIP-97ETXB
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 748	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	85
PID 1764 wrote to memory of 4732	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	86
PID 1764 wrote to memory of 4732	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	86
PID 1764 wrote to memory of 4732	1764	28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe	86

C:\Users\Admin\AppData\Local\Temp\28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe
"C:\Users\Admin\AppData\Local\Temp\28027242d50c7ac56bf9c3d03be17b9f93e857b171b65222c20d679048c42793.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:748
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:4732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-8-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-7-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-9-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-5-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-4-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-53-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/748-66-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1764-3-0x0000025A73270000-0x0000025A73340000-memory.dmp

Filesize
832KB

Download
memory/1764-2-0x00007FFEC13A0000-0x00007FFEC1E61000-memory.dmp

Filesize
10.8MB

Download
memory/1764-1-0x0000025A57B30000-0x0000025A57B3E000-memory.dmp

Filesize
56KB

Download
memory/1764-0-0x00007FFEC13A3000-0x00007FFEC13A5000-memory.dmp

Filesize
8KB

Download
memory/1764-10-0x00007FFEC13A0000-0x00007FFEC1E61000-memory.dmp

Filesize
10.8MB

Download