remcos | 4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62

General

Target

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
Size

1.8MB
MD5

bff99dbf40860a95a9191ebc79dc1472
SHA1

ad46a8edc27d43c07f915ba194e91426e1856d8b
SHA256

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62
SHA512

ffaac70950b6341bcdd1a8e2822c2014d4b4b0f24f9d38c0decbe05a9c2b7bbe4f4ef8ba279badc1c82ad19f45e180cbacede302b30ce445af02568911e3c0e2
SSDEEP

49152:8PVt/LZeJbInQRav7WTSXjoHRYJQWgRKCM:CTYbInQOKSXjoHRYJn6KCM

Score

10^/10

remcos remotehost discovery rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

154.216.17.14:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KC5V8F
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

description	pid	process	target process
PID 2348 set thread context of 3056	2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

pid process

2348 4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

pid	process
2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

pid	process
2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

description	pid	process	target process
PID 2348 wrote to memory of 3056	2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	svchost.exe
PID 2348 wrote to memory of 3056	2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	svchost.exe
PID 2348 wrote to memory of 3056	2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	svchost.exe
PID 2348 wrote to memory of 3056	2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	svchost.exe
PID 2348 wrote to memory of 3056	2348	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
"C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe"
  2⤵
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-2-0x0000000002B20000-0x0000000002C20000-memory.dmp

Filesize
1024KB

Download
memory/3056-3-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-5-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-8-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-7-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-9-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-10-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3056-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads