remcos | 5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe
Size

1.8MB
MD5

5d0fc271f0606b92ab5c9ad53a790cb0
SHA1

c127a41f0cbd5fdb93126f99df6b411db705051c
SHA256

5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b
SHA512

295be396acfb54e1211a54479aa628d67ba6e0658533724b9b19e904bbbc509170fe53b3d4b179a7837f766a29a83d86d24baf8fdd52ae5068b83bd5f00ed7e5
SSDEEP

49152:9ayHCQ8W4dod2vKSsd4rGj8fCs4bIwaRsAOwcd0bVNtcqOjLc:UE8oQvj+wpwaqAOd0JcqY

Score

10^/10

remcos spacolombia2707raptor persistence rat

Malware Config

Extracted

Family

remcos

Botnet

spacolombia2707RAPTOR

areaseguras.con-ip.com:2707

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
loggsdSSC
keylog_path
%AppData%
mouse_option
false
mutex
Rmc121455011-7TOVMS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pzpgzqlkyf = "C:\\Users\\Admin\\AppData\\Roaming\\Pzpgzqlkyf.exe"	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe
Token: SeDebugPrivilege	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2288	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86
PID 2020 wrote to memory of 2288	2020	5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe	86

C:\Users\Admin\AppData\Local\Temp\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe
"C:\Users\Admin\AppData\Local\Temp\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe
  "C:\Users\Admin\AppData\Local\Temp\5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\loggsdSSC\logs.dat

Filesize
184B

MD5
a93ae0ec464f32dd14941d00b5be6c89

SHA1
6776268e3077fd806acd18109562cd4c1ff3b840

SHA256
0f4770eb6ece55eda924241128e5f9b1262f5322ec120d9c8d7a6805e4f377bc

SHA512
54d79b57bf4f07e531651ef85f7d32d23e2bd6fd631c3c04d73e06010f7bd7c65bff74b905190d8f39ee614a0db6c6d16fc420cab33e4e0b58134bdcda948863

Download Submit
memory/2020-42-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-58-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-3-0x0000000004F20000-0x00000000050E8000-memory.dmp

Filesize
1.8MB

Download
memory/2020-4-0x00000000051F0000-0x000000000544C000-memory.dmp

Filesize
2.4MB

Download
memory/2020-5-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-8-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-22-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-32-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-46-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-56-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-60-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-68-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-66-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-64-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-62-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-38-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-55-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-52-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-50-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-48-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-44-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-0-0x00000000745CE000-0x00000000745CF000-memory.dmp

Filesize
4KB

Download
memory/2020-2-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2020-40-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-4868-0x0000000005120000-0x00000000051BA000-memory.dmp

Filesize
616KB

Download
memory/2020-34-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-30-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-28-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-26-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-24-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-20-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-16-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-14-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-10-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-6-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-18-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-12-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-4867-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2020-36-0x00000000051F0000-0x0000000005445000-memory.dmp

Filesize
2.3MB

Download
memory/2020-4869-0x0000000005450000-0x000000000549C000-memory.dmp

Filesize
304KB

Download
memory/2020-4870-0x0000000005DA0000-0x0000000006344000-memory.dmp

Filesize
5.6MB

Download
memory/2020-4871-0x0000000005600000-0x0000000005654000-memory.dmp

Filesize
336KB

Download
memory/2020-1-0x0000000000310000-0x00000000004E8000-memory.dmp

Filesize
1.8MB

Download
memory/2020-4878-0x00000000745C0000-0x0000000074D70000-memory.dmp

Filesize
7.7MB

Download
memory/2288-4893-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2288-4877-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads