remcos | 6699c01aeb3c522aa25ab28fb1c269321839f93c136aeae62f16ea4adc4b9aa6

Analysis

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Inquiry-PA4810.exe
Size

1.3MB
MD5

2eb62b4422d2f4796766333f77439a46
SHA1

d05310de4d0e724a62936c44862f5a98692a4f50
SHA256

ac7c0664851b8be645cbc51bf2e88490fae12671619017b755547e95fd5601b4
SHA512

07c53505560e3faf40db0de3d45ad6cc9eaad8e525d2b64b227259dc2d11d4ab2586b8f428bf166d74738db87f176a1edeed21433a502b6e046e673e22873bf3
SSDEEP

24576:wtb20pkaCqT5TBWgNQ7ap1BUKFYsjuCKfPvnWVJyBZ6A:5Vg5tQ7afqKfy3f48z5

Score

10^/10

remcos mo discovery rat

Malware Config

Extracted

Family

remcos

Botnet

mo201.ddns.net:1088

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-R95UJZ
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1300 set thread context of 4624	1300	Inquiry-PA4810.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inquiry-PA4810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1300	Inquiry-PA4810.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1300	Inquiry-PA4810.exe
1300	Inquiry-PA4810.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1300	Inquiry-PA4810.exe
1300	Inquiry-PA4810.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4624	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 4624	1300	Inquiry-PA4810.exe	89
PID 1300 wrote to memory of 4624	1300	Inquiry-PA4810.exe	89
PID 1300 wrote to memory of 4624	1300	Inquiry-PA4810.exe	89
PID 1300 wrote to memory of 4624	1300	Inquiry-PA4810.exe	89

C:\Users\Admin\AppData\Local\Temp\Inquiry-PA4810.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry-PA4810.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Inquiry-PA4810.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
1d0c8e27055a0e18e14b7a3058a9e2d3

SHA1
f759df4f9a1ff8c6e1583d945cc8f2acb9c52352

SHA256
f3cd8ffc9cf3a00297c46b89b8946f8f1b68a6338ccfb9c44de418543821a274

SHA512
39c6f0a249f9a804c89a54298b49600df298f8e7c8bb2ec5fc8b512037cf697e176e770304d51a0f159caf27dac6ab7a400ae73146a2f79badb2baf38dfe7b1e

Download Submit
memory/1300-11-0x0000000000870000-0x0000000000874000-memory.dmp

Filesize
16KB

Download
memory/4624-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4624-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download