remcos | 4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62

General

Target

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
Size

1.8MB
MD5

bff99dbf40860a95a9191ebc79dc1472
SHA1

ad46a8edc27d43c07f915ba194e91426e1856d8b
SHA256

4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62
SHA512

ffaac70950b6341bcdd1a8e2822c2014d4b4b0f24f9d38c0decbe05a9c2b7bbe4f4ef8ba279badc1c82ad19f45e180cbacede302b30ce445af02568911e3c0e2
SSDEEP

49152:8PVt/LZeJbInQRav7WTSXjoHRYJQWgRKCM:CTYbInQOKSXjoHRYJn6KCM

Score

10^/10

remcos remotehost discovery rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

154.216.17.14:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KC5V8F
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 216 set thread context of 808	216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	94

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1684	1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	86
PID 1892 wrote to memory of 1684	1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	86
PID 1892 wrote to memory of 1684	1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	86
PID 1892 wrote to memory of 3076	1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	87
PID 1892 wrote to memory of 3076	1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	87
PID 1892 wrote to memory of 3076	1892	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	87
PID 3076 wrote to memory of 1032	3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	90
PID 3076 wrote to memory of 1032	3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	90
PID 3076 wrote to memory of 1032	3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	90
PID 3076 wrote to memory of 216	3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	91
PID 3076 wrote to memory of 216	3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	91
PID 3076 wrote to memory of 216	3076	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	91
PID 216 wrote to memory of 808	216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	94
PID 216 wrote to memory of 808	216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	94
PID 216 wrote to memory of 808	216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	94
PID 216 wrote to memory of 808	216	4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe	94

C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
"C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe"
  2⤵
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
  "C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe
    "C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\4599a9128ac5671a5e3ac44778542f3e67969e1c6f5021279329bf0e45085c62.exe"
      4⤵
      PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-10-0x00000000037D0000-0x00000000038D0000-memory.dmp

Filesize
1024KB

Download
memory/808-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1892-2-0x0000000003CB0000-0x0000000003DB0000-memory.dmp

Filesize
1024KB

Download
memory/3076-6-0x00000000040F0000-0x00000000041F0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing