Extracted

• • Target

    remcos_a.exe

  • Size

    469KB

  • MD5

    04a1c15b1c4997aa7330ec2a2db7ea6c

  • SHA1

    66818bc414329e57bd8952e1d958abc0c3499436

  • SHA256

    52d96d5bcefcb3fc8fb937370e843aa4b2647adea1f236cd65ee4de1d199c119

  • SHA512

    251ed575705bb5afcbfd326d9302d53bf0f9d67a5474cd36b55a5dbc823a529e1be4f60f78b96441bd79220cc028286d7aeb4d8deac18a4a2a5f4953730ba1aa

  • SSDEEP

    12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS3n9:uiLJbpI7I2WhQqZ739

  Score

  10^/10

  remcosremotehostdefense_evasiondiscoveryevasionexecutionpersistencerattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1