remcos | c56c00ca3f42026f17affef76b3752f268d1498f862b3143985ca7c1d33feb39

Resubmissions

21-01-2025 13:35

250121-qvptgawqbk 10

21-01-2025 11:58

21-01-2025 11:44

21-01-2025 11:07

17-07-2024 20:08

Analysis

max time kernel
57s
max time network
50s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
17-07-2024 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

borlndmm.dll
Size

2.8MB
MD5

eb6fad4894d0b420b92c00acda8122ae
SHA1

8be6dfa8e216d2f7b68f2ab05e63a78fa51374f6
SHA256

18a26f67712f75a9251e8350089fc83d55c33f2fa82c46e5f67f1d6dc5716a4a
SHA512

4cbaad723076f539788acca418dcc9234d0c9d2978978a855cd670a6ad2300ebe4bb28c35fc048494df30c9d76bead5b6aae1b26168e6e0b230d34ac8797202e
SSDEEP

49152:1MkOevf30HlhHRPErtXFqVn1P2Rt8fUaRMXA3IloTf7OFk/41NjwT7x7uFh1hz:kY1Un1P2Rt8fUaRMXkuwB7uF5z

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

23.254.224.59:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-6LCEJ4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	4520	rundll32.exe
3	4520	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3112	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 3112	4208	rundll32.exe	79
PID 4208 wrote to memory of 3112	4208	rundll32.exe	79
PID 4208 wrote to memory of 3112	4208	rundll32.exe	79
PID 3112 wrote to memory of 4520	3112	rundll32.exe	80
PID 3112 wrote to memory of 4520	3112	rundll32.exe	80
PID 3112 wrote to memory of 4520	3112	rundll32.exe	80
PID 3112 wrote to memory of 4520	3112	rundll32.exe	80
PID 3112 wrote to memory of 4520	3112	rundll32.exe	80
PID 3112 wrote to memory of 4520	3112	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\borlndmm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\borlndmm.dll,#1
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - Blocklisted process makes network request
    PID:4520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3112-11-0x0000000010278000-0x000000001027C000-memory.dmp

Filesize
16KB

Download
memory/3112-0-0x0000000010000000-0x00000000102C6000-memory.dmp

Filesize
2.8MB

Download
memory/3112-2-0x0000000010000000-0x00000000102C6000-memory.dmp

Filesize
2.8MB

Download
memory/3112-5-0x0000000010000000-0x00000000102C6000-memory.dmp

Filesize
2.8MB

Download
memory/3112-9-0x00000000102AB000-0x00000000102C6000-memory.dmp

Filesize
108KB

Download
memory/3112-7-0x0000000010281000-0x00000000102AA000-memory.dmp

Filesize
164KB

Download
memory/3112-13-0x00000000102AE000-0x00000000102C6000-memory.dmp

Filesize
96KB

Download
memory/3112-1-0x0000000010004000-0x000000001001E000-memory.dmp

Filesize
104KB

Download
memory/3112-10-0x0000000010274000-0x0000000010278000-memory.dmp

Filesize
16KB

Download
memory/3112-12-0x000000001027C000-0x00000000102AA000-memory.dmp

Filesize
184KB

Download
memory/4520-6-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-18-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-14-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-15-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-3-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/4520-8-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-17-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-16-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-19-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-22-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-23-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-24-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-25-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/4520-26-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download