remcos | eb2f5e83516287b514acba3a14eaeca18455d443db5ae8949c56acece871bcbe

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe
Size

463KB
MD5

2c528cc769588b0e27903bc6cea1b32a
SHA1

6f8060e5f0d1944167c04b8e6d6b1a7c6bd963a7
SHA256

4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a
SHA512

ff08287a8d09673477c336054a8f07acf078185f5f06007fde9f53fc21fa9e1ebe65251a09339ebb9c869ea4c5e76f0480a757d7366ad2b7b3b3cb66db48d2ba
SSDEEP

12288:roCqKde3G314caiojGRoaOd+2sfZsvVg:UAdIG314cFo4Od+NZSS

Score

10^/10

remcos discovery rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe

C:\Users\Admin\AppData\Local\Temp\4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe
"C:\Users\Admin\AppData\Local\Temp\4d360c43c33251a91ea260075eae7f6d02fbbb885e9f15abb7da2ca31f51068a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
144B

MD5
bc87930d00d27345b017d78621f604ec

SHA1
127124afc1dc8f2b19bb843d9ffcc58c95a69ca6

SHA256
e8635c7be1a1898cd278fe42e6b920518dadab2baf4e4dfd88ce1c8f3426b9aa

SHA512
fc7b774e3135cafa5408bb75b8b091c756950d0c352118ff88b010db385088dc5ecb5c4e24bf6c82082f74cbed0b25588dffde8cf8e1579af0215419c9b3fbb4

Download Submit