remcos | 148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe
Size 2.7MB
Sample240606-bf16maeb88
SHA256 148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f
MD5 95626a1bca4871e5d3fd14604d688c71
SHA1 e0e3eb52e2850d9643d1342871b8baf9d5f822e0
SHA512 c8e3a4a8bda0bf9c04636360090a05498f6b8c3e6702deca16e05f0ca2e7bf8775e23fe5c6c069f9dadfa30078686f7324649708fdf5117b9c5755c5a8dca589
SSDEEP 49152:pREWXUCXkRX9i5dNgz42P1jxWRf29KbYZl4bZQF:gWvCscWN29mYZabk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos kgb rat

Malware Config

Extracted

Family

remcos

Botnet

bossnacarpet.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
chrome-VYSLR4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 20 IoCs

resource	yara_rule
behavioral2/memory/4956-2-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-4-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-3-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-1-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-0-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-5-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-7-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-6-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-8-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-11-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-12-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-13-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-15-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-14-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-17-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-16-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-18-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-19-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-20-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4956-21-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4272 set thread context of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4204	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	86
PID 4272 wrote to memory of 4204	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	86
PID 4272 wrote to memory of 4204	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	86
PID 4272 wrote to memory of 4204	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	86
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87
PID 4272 wrote to memory of 4956	4272	148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe	87

C:\Users\Admin\AppData\Local\Temp\148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe
"C:\Users\Admin\AppData\Local\Temp\148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  PID:4204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4956-2-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-4-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-3-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-1-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-0-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-5-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-7-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-6-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-8-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-11-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-12-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-13-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-15-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-14-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-17-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-16-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-18-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-19-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-20-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4956-21-0x0000000000400000-0x0000000000482000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads