remcos | 6f0a6a80a363a3ef5f5839b7d8cc36ae251bcac36fbb5c364b5ccf1cd7640c8b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf.exe
Size

124KB
MD5

836f20f29fe33a7f80578d36dd3429c6
SHA1

edbea84969b18b9e241a3bc7fe4b61dd302f58a9
SHA256

e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf
SHA512

abeecfd989d81b50ef8a50f2ccf51c26c29245c02e081d93beca68d5f2b1865e974213a3140e1a599764a60b462d73789d6c483b555d17e975d8e18fc88cb0f2
SSDEEP

3072:MGuV8ukp57/RLyBlNJo4s5ln8m5IYNG2k4OzqhaIrc+5:MGuVUD7/5yBP3s5p8m5IYNG2tOzqhaU

Score

10^/10

remcos discovery rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4436	e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf.exe

C:\Users\Admin\AppData\Local\Temp\e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf.exe
"C:\Users\Admin\AppData\Local\Temp\e5d56a9880242b2d754c16974f3f35a91b98de9fbaf718360ca64099e13a38bf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
79B

MD5
a158f5c6e90fd3b95543d6b86f194091

SHA1
9fc118a54a2896da04a29f655a0e4c583dfed17a

SHA256
6e4234097497da5df3366c5e693a71f4bac9aeff24972999532b2a8e8cf6a432

SHA512
52407b54120c2ad91e271fa4a6ececf34cc480ed259864dcb4ebd9d94149b52dd180c36673c6557ef2caa2295912a3e87ac545874cf9a0430e6aadb2072eabc9

Download Submit