remcos | c56c00ca3f42026f17affef76b3752f268d1498f862b3143985ca7c1d33feb39

Resubmissions

21-01-2025 13:35

250121-qvptgawqbk 10

21-01-2025 11:58

21-01-2025 11:44

21-01-2025 11:07

17-07-2024 20:08

Analysis

max time kernel
60s
max time network
36s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
17-07-2024 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe
Size

1.9MB
MD5

c318036044f10d288cedac36d81a611b
SHA1

442245535cd0c4876f784a28fdbf6a32bb70e220
SHA256

938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598
SHA512

6043678915f0893b3fbca5633dc1effe2e27d0f25eb1da413b14b93aa4204334b8792fee3e67bbfc905cc0130748afbec6fc6aaf834fe7c168a430bd06d769da
SSDEEP

24576:MDXpgvsPjx71gWufN62I520/hjlB6iTzKF+iZpWWt5YY7tOvkIOTUQvb7Mhh21:MDevYxSNudSrZpWKd7tOvJOpb7K81

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

4.9.3 Light

Botnet

RemoteHost

127.0.0.1:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52SPIJ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1924	938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1924	2840	938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe	82
PID 2840 wrote to memory of 1924	2840	938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe	82
PID 2840 wrote to memory of 1924	2840	938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe	82
PID 2840 wrote to memory of 1924	2840	938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe	82
PID 2840 wrote to memory of 1924	2840	938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe	82

C:\Users\Admin\AppData\Local\Temp\938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe
"C:\Users\Admin\AppData\Local\Temp\938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe
  "C:\Users\Admin\AppData\Local\Temp\938b7e042bda75e416261e46d0d4873781fd5d53c2ce6c2748b92eeb8a826598.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-22-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-34-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-3-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-5-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-46-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-11-0x0000000000400000-0x0000000000601000-memory.dmp

Filesize
2.0MB

Download
memory/1924-44-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-43-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-42-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-23-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-13-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-12-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-40-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-14-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-39-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-15-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-16-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-17-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-18-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-19-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-20-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-21-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-45-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-41-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-27-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-25-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-26-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-24-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-28-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-29-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-30-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-31-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-32-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-33-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-1-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-35-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-36-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-37-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/1924-38-0x00000000000C0000-0x0000000000135000-memory.dmp

Filesize
468KB

Download
memory/2840-2-0x0000000000400000-0x0000000000601000-memory.dmp

Filesize
2.0MB

Download
memory/2840-4-0x0000000000407000-0x0000000000421000-memory.dmp

Filesize
104KB

Download
memory/2840-6-0x00000000005BE000-0x00000000005C2000-memory.dmp

Filesize
16KB

Download
memory/2840-7-0x00000000005C2000-0x00000000005CA000-memory.dmp

Filesize
32KB

Download
memory/2840-8-0x00000000005C5000-0x00000000005CA000-memory.dmp

Filesize
20KB

Download
memory/2840-9-0x00000000005C9000-0x00000000005FB000-memory.dmp

Filesize
200KB

Download
memory/2840-0-0x0000000000400000-0x0000000000601000-memory.dmp

Filesize
2.0MB

Download
memory/2840-10-0x00000000005CE000-0x00000000005FB000-memory.dmp

Filesize
180KB

Download