remcos | 004c59e17178ebbc86da08ea93eb39064a86f5d1be7c18d330c15f80dde8504b

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads/borlndmm.dll
Size

2.8MB
MD5

eb6fad4894d0b420b92c00acda8122ae
SHA1

8be6dfa8e216d2f7b68f2ab05e63a78fa51374f6
SHA256

18a26f67712f75a9251e8350089fc83d55c33f2fa82c46e5f67f1d6dc5716a4a
SHA512

4cbaad723076f539788acca418dcc9234d0c9d2978978a855cd670a6ad2300ebe4bb28c35fc048494df30c9d76bead5b6aae1b26168e6e0b230d34ac8797202e
SSDEEP

49152:1MkOevf30HlhHRPErtXFqVn1P2Rt8fUaRMXA3IloTf7OFk/41NjwT7x7uFh1hz:kY1Un1P2Rt8fUaRMXkuwB7uF5z

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

23.254.224.59:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-6LCEJ4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	4244	rundll32.exe
15	4244	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2756	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2756	2080	rundll32.exe	84
PID 2080 wrote to memory of 2756	2080	rundll32.exe	84
PID 2080 wrote to memory of 2756	2080	rundll32.exe	84
PID 2756 wrote to memory of 4244	2756	rundll32.exe	85
PID 2756 wrote to memory of 4244	2756	rundll32.exe	85
PID 2756 wrote to memory of 4244	2756	rundll32.exe	85
PID 2756 wrote to memory of 4244	2756	rundll32.exe	85
PID 2756 wrote to memory of 4244	2756	rundll32.exe	85
PID 2756 wrote to memory of 4244	2756	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Downloads\borlndmm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Downloads\borlndmm.dll,#1
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - Blocklisted process makes network request
    PID:4244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-7-0x0000000010000000-0x00000000102C6000-memory.dmp

Filesize
2.8MB

Download
memory/2756-2-0x0000000010000000-0x00000000102C6000-memory.dmp

Filesize
2.8MB

Download
memory/2756-1-0x0000000010004000-0x000000001001E000-memory.dmp

Filesize
104KB

Download
memory/2756-0-0x0000000010000000-0x00000000102C6000-memory.dmp

Filesize
2.8MB

Download
memory/2756-13-0x00000000102AE000-0x00000000102C6000-memory.dmp

Filesize
96KB

Download
memory/2756-9-0x00000000102AB000-0x00000000102C6000-memory.dmp

Filesize
108KB

Download
memory/2756-11-0x000000001027C000-0x00000000102AA000-memory.dmp

Filesize
184KB

Download
memory/2756-12-0x0000000010281000-0x00000000102AA000-memory.dmp

Filesize
164KB

Download
memory/4244-3-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/4244-22-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-15-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-10-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-6-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-16-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-17-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-18-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-21-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-8-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-23-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-24-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-26-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-27-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-28-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-30-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download
memory/4244-31-0x0000000001000000-0x0000000001082000-memory.dmp

Filesize
520KB

Download