remcos | 635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcd2251a8050b590a00cfe90dde9bd4c.exe
Size 672KB
Sample240609-thg5msch67
SHA256 635afa4851ab707d7527325d132caabb0387cb5a3ae3eccee23b3c8891fff4d5
MD5 fcd2251a8050b590a00cfe90dde9bd4c
SHA1 5b05d0854a21630e891590d85c94fa9fbbb6a8c7
SHA512 eb4acb519c71325a4cfd2dab660a8c85605600f2a1fba8c5b8a03a84e814e1feb05e40399ea9615816a5f048cecb00f536b26eff2a99c0fa693cefc27772822e
SSDEEP 12288:NPzeh+nPLUUv4hVpyWSdPiwjllCr7up5dfLA:xSVpyWSdP9jlIKfk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

RemoteHost

185.140.53.144:8691

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
dancas
keylog_path
%AppData%
mouse_option
false
mutex
Amdosc-JSJ6ES
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Warcha.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Paranada\\Girana.exe"	fcd2251a8050b590a00cfe90dde9bd4c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2964	fcd2251a8050b590a00cfe90dde9bd4c.exe
2404	fcd2251a8050b590a00cfe90dde9bd4c.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94
PID 2964 wrote to memory of 2404	2964	fcd2251a8050b590a00cfe90dde9bd4c.exe	94

C:\Users\Admin\AppData\Local\Temp\fcd2251a8050b590a00cfe90dde9bd4c.exe
"C:\Users\Admin\AppData\Local\Temp\fcd2251a8050b590a00cfe90dde9bd4c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\fcd2251a8050b590a00cfe90dde9bd4c.EXE
  "C:\Users\Admin\AppData\Local\Temp\fcd2251a8050b590a00cfe90dde9bd4c.EXE"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\Users\Admin\AppData\Roaming\dancas\logs.dat
Size 74B
SHA256 30e5e862618c61bbb2e5d6fae6d8eb1717ad18d2dfaeee39f7e0329d1290dbe2
MD5 7d65dd50d0150208ef224adc2fd7a63e
SHA1 245996cea5f374dc462ba0875285a756d246aea5
SHA512 6b2f033c3edcd66ca4ad62849c1457eb751abd3a8309d8e6a0fccdfbff0b69484586c6022bff2769cd64b42d7b777b08cbdec63187a7c5b755151243d3106420
MD5 SHA1 SHA512

Submit Download

memory/2404-4-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2404-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2404-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2404-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2404-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2404-13-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2404-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2404-21-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2404-25-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2404-29-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads