remcos | af59beeaecb34c9a9892f21771f3fa06d633e9d8f82c70fcd48fe30871c6f539

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Doc_993848837483937493948394.exe
Size 2.5MB
Sample240614-bq19datbqn
SHA256 507866f9b6cab33d6721a4a76c1acdc0b5ee1ee7335cb82af3bd3dec5a5ebf16
MD5 927c5cd0cad3ee37ac7578dc0737baf5
SHA1 a6950651f0f7c3b917b01f0cff43b88a0145c3ff
SHA512 4f710960bfb18ec724407976984668b78029bf4606a28de2a50663f47bf7e440e79b6a09214d832389169acfbb0740f32fe4ed20b6cba7a29e144a873e634a7f
SSDEEP 24576:dk8gl9VOXyYiytbtQu6ZIrYeTh9LgLKdZ6w:dk8gTUTFbtGzah9LbT/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

107.173.4.16:2560

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KDW6BI
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 4528	1872	Doc_993848837483937493948394.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	Doc_993848837483937493948394.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4528	wmplayer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 3556	1872	Doc_993848837483937493948394.exe	85
PID 1872 wrote to memory of 3556	1872	Doc_993848837483937493948394.exe	85
PID 1872 wrote to memory of 3556	1872	Doc_993848837483937493948394.exe	85
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4764	1872	Doc_993848837483937493948394.exe	86
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 4528	1872	Doc_993848837483937493948394.exe	87
PID 1872 wrote to memory of 552	1872	Doc_993848837483937493948394.exe	88
PID 1872 wrote to memory of 552	1872	Doc_993848837483937493948394.exe	88
PID 1872 wrote to memory of 552	1872	Doc_993848837483937493948394.exe	88

C:\Users\Admin\AppData\Local\Temp\Doc_993848837483937493948394.exe
"C:\Users\Admin\AppData\Local\Temp\Doc_993848837483937493948394.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:3556
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4764
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4528
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 184B
SHA256 0da677a47e158878a177c53d7e32a407c68554c5cad23ea7e069c8ee1d3bf50d
MD5 d929c7307208c5f5e5b9d5529a695e92
SHA1 c3d27a5968d21f649e002dbd909d20fd32f6a9ce
SHA512 aebedcbbbc99a3a82a4c04e7a29e6bfe446addf9af3ea44c95cb819aefc79d5c182ede172c825ead711aef1172140a853e6960f5c2fc136ce4c25a1f2d738517
MD5 SHA1 SHA512

Submit Download

memory/1872-0-0x00007FFA2B193000-0x00007FFA2B195000-memory.dmp

Download

memory/1872-1-0x000001FAA7070000-0x000001FAA7090000-memory.dmp

Download

memory/1872-2-0x00007FFA2B190000-0x00007FFA2BC51000-memory.dmp

Download

memory/1872-3-0x000001FAC15C0000-0x000001FAC1690000-memory.dmp

Download

memory/1872-13-0x00007FFA2B190000-0x00007FFA2BC51000-memory.dmp

Download

memory/4528-6-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-21-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-12-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-8-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-7-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-5-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-4-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-19-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-20-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-11-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-26-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-27-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-32-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-34-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-39-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-40-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-45-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-46-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-52-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4528-53-0x0000000000400000-0x0000000000482000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads