remcos | eb2f5e83516287b514acba3a14eaeca18455d443db5ae8949c56acece871bcbe

Analysis

max time kernel
147s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe
Size

463KB
MD5

2c528cc769588b0e27903bc6cea1b32a
SHA1

6f8060e5f0d1944167c04b8e6d6b1a7c6bd963a7
SHA256

4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a
SHA512

ff08287a8d09673477c336054a8f07acf078185f5f06007fde9f53fc21fa9e1ebe65251a09339ebb9c869ea4c5e76f0480a757d7366ad2b7b3b3cb66db48d2ba
SSDEEP

12288:roCqKde3G314caiojGRoaOd+2sfZsvVg:UAdIG314cFo4Od+NZSS

Score

10^/10

remcos discovery rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2112	4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe

C:\Users\Admin\AppData\Local\Temp\4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe
"C:\Users\Admin\AppData\Local\Temp\4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
144B

MD5
605b70fe0b4b75425b5d655e4d48a8cd

SHA1
d31b5045ce81000e2a084d1e9024ccbd7faa0a96

SHA256
d385b53ad79ed24c2909d1dcc02a40562d350957163348a57f492e1327fde592

SHA512
b86b62e3a75cdbed62ef406aad5ad94c359db31ad29932b5d801ef1c1283f9bb0a3b4cfcfe9e65b40b84b430cacbd365ac8d6bbb96d8bec3240dd988b5ee3b43

Download Submit