Analysis
-
max time kernel
330s -
max time network
329s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 16:33
General
-
Target
Remcos v5.3.0 Light.exe
-
Size
38.5MB
-
MD5
be1aa2a7600e0845d73cd004cd385135
-
SHA1
b49bfa8ada17ce0f4497a2f2e589824e700360ba
-
SHA256
20fefa38a50cd99ab81181ab99bee40c3639dbdd465ce2e277eebf1bd6308433
-
SHA512
adea6c19d96435f853cfa4685f836d20970d944d8155b0ec9d30b7ba3499bb46d9b3125a5a3baf5c244247de3ccd79de0835a3bbc0416b36083e78a1fc865e10
-
SSDEEP
786432:i3hQRdPjIyoLKX7ho1zqC0tIvNFom4jeA+bG:vvPj0CNUzqCYSaLjeZa
Malware Config
Extracted
remcos
5.3.0 Light
RemoteHost
181.215.176.83:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-403792
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos v5.3.0 Light.exe"C:\Users\Admin\AppData\Local\Temp\Remcos v5.3.0 Light.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Remcos v5.3.0 Light.exe"C:\Users\Admin\AppData\Local\Temp\Remcos v5.3.0 Light.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ""C:\Users\Admin\AppData\Local\Temp\mpress.exe" "C:\Users\Admin\Downloads\remcos_a.exe""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mpress.exe"C:\Users\Admin\AppData\Local\Temp\mpress.exe" "C:\Users\Admin\Downloads\remcos_a.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ""C:\Users\Admin\AppData\Local\Temp\mpress.exe" "C:\Users\Admin\Downloads\remcos_b.exe""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mpress.exe"C:\Users\Admin\AppData\Local\Temp\mpress.exe" "C:\Users\Admin\Downloads\remcos_b.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\remcos_a.exeremcos_a.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\Downloads\remcos_b.exeremcos_b.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 5484⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\remcos_b.exeremcos_b.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 5284⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\remcos_a.exeremcos_a.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1852 -ip 18521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4264 -ip 42641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
398B
MD5642bc34a7a126920ed0f63f4d0116f86
SHA12712bfa8c3ef7300cf3ab1608ed003bc9e57dcac
SHA2567b96a63060f8adab050351e274917119153a85295b541c8d3251fbd9574d1373
SHA5124bcc6ef75839e29b59ea01c627e00be8b325b0dafb8282ddb0c4c96d13f09aeba83f3d624274dc605b371d110725c31c8361f8bf52100deb2730110935e4b390
-
Filesize
403B
MD50f7c1a125acacf4b898876519f933cfc
SHA1718d96cae88d1a9dc22250d0698d86126d171096
SHA256122b817ca9c27bd5a27afa6dd3ba156adbdaf8844f0cfb4e509e6367378cfacd
SHA5120917b498d2ed0abf534c260e673ce31fad22ae58a36703385b99cadc24d38d93a95520262994ec14997e138cf48bce0ef04d579009cd1ea339ab442e1810f295
-
Filesize
73B
MD5d6ebf2e3bc1043da4bde77ca18fe5241
SHA11372fbc53fe057e2568c72c96dd02a43f048645c
SHA256d1af1101393e6382a92bd26e4931443a07f187d2f044296cec06dd92d86e141e
SHA512b38e596c43ff1121feee76e96481501596ccd4f2852754da7c5e818a25851c5651aa804b47547d66c191ddb563f979da9e9f8d7eec6a90ed599a4a968c71387e
-
Filesize
34B
MD5531582397f8ccb5247d113822217d9bc
SHA18667d320df908771d15874dca81cc44d80f8c3aa
SHA25661d2e1420b59b2d8caba08c4710416aca5ac5d86fc525e81536300ac09493b4a
SHA512be88b1d9c0d88f69b0a9107eda08c51bf40c3cfc9df5f7a0ee62ca3e2fbc9a0998fbfb644e828fc1b367b5ffed885845d1888d2d26998fa14b401420aaaf4999
-
Filesize
55B
MD5fbbef4b611ff617690446c4638cc595f
SHA143e63aa2a81fc0c5a65ecebac7ea03b769dcaae8
SHA2561b367ba5af9d77c7b400bc6997547b88e375806da9b4d124edc838fb789873ba
SHA5128034f0546fcd05c76aa975020ffa02fcba2d5c405d25fe2ba633c9f95b8bb01ce6a3379ce63920d5780289a829d2b99232c589a0a75bfc2638b8312bc5596e78
-
Filesize
1.3MB
MD5fa5def992198121d4bb5ff3bde39fdc9
SHA1f684152c245cc708fbaf4d1c0472d783b26c5b18
SHA2565264a4a478383f501961f2bd9beb1f77a43a487b76090561bba2cbfe951e5305
SHA5124589382a71cd3a577b83bab4a0209e72e02f603e7da6ef3175b6a74bd958e70a891091dbdff4be0725baca2d665470594b03f074983b3ed3242e5cd04783fdba
-
Filesize
633B
MD5455202a8f0a78e84919556a4f31f8eca
SHA12c0578b13ee09cfc203f246cbdcf28429486532b
SHA2568548191e26d4adc20b3a9dd09eef3e44a2acf0060f373f35b789a6a6c4635dd7
SHA512ae848d22991816b0616757b26cc90f889612cf20accb559234c08fe1d8a95a87bbe110d55ee6337433d8afc56b01d247e4a554b76d2c47ce1db1306b852d1899
-
Filesize
633B
MD5c18055f9cd574d28d2d08d64a9c9c750
SHA1f6979dbd9d3a65b5cafb4393fd363ba2704b6354
SHA256e03a2afb34fc54d65443c56b1056209ceeab089a513daf3717ad364ee7c84c9e
SHA5120ed56bb2fa235e8008422a7a72a309c69cd1d0748a83a4aa39446d45738a017e099c4fce449ee642b8ef61863fdac5a8b4fe63b6ff38e481808eec7b9a38c35a
-
Filesize
330KB
MD52117e31688aef8ecf267978265bfcdcd
SHA1e8c3cfd65ed7947f23b1bb0b66185e1e73913cfc
SHA2560a4031ab00664cc5e202c8731798800f0475ef76800122cebd71d249655d725f
SHA512dd03899429c2d542558e30c84a076d7e5dbde5128495954093a7031854c1df68f8ff8eca4c791144937288b084dd261fbe090c4ff9a3e0768e26f0616b474eca
-
Filesize
197KB
MD5c4281e03dd32290db33319f1ad1fe351
SHA19c35cec3adc61b0fbd063453ca82a6a68880f87d
SHA2568c1a6824ce078ca85456e715f257d35a166bd70fc701d53dc3ed04c315189eb6
SHA51281389756b7f347efac5ba2d1622d5c4b4f9ce56ec74dc706ec20299fa91e89a2d3ad71775241d08dfbf0cc9f730993c540997e0f4c21877d6c257c2e48ea89ef
-
Filesize
101KB
MD58b632bfc3fe653a510cba277c2d699d1
SHA1d6a57aa17e5eb51297def9bac04e574c1e36d9c7
SHA2562852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
SHA512b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
-
Filesize
429KB
MD54912af835a8faefa7f56957d2ef0cb8d
SHA11aa3bed30098c6b3355362be9a7a95db5657f48d
SHA25681f716dfd98e532b59690cc881cfb8894428fd8dcaabdc581d3a87229e06cf13
SHA512974f83debb4f1f81d7e7687bcf91c3a0ec7f1ded10af7b44599d07ad6ad9ab8a0174def27be737ae49c4596125e02874a2a123468ad89c1ae3ecab44deb8f3aa
-
Filesize
428KB
MD5c5f09b7719c8b0fff49750c4207b06b2
SHA1a4e05827087c2db01d12677bde55079d549271a3
SHA256254062f88f40324329b91a934ecd2b38355225a18f90e0d6f6588f8e181163b8
SHA512d69a070d0ef9e937be6c5aba18ae21ba37f6a2c502a1b8d48ae9d088d338f3134b52ec1b920ceec9d2450b59bd90ac37b90b966ac3cabdc4304d83cb2b4742c0
-
Filesize
195KB
MD51108bc0d887de437b7826c80badca6f3
SHA1aa22b26d848da989b5154a6965ffdd1e0270a061
SHA2568cd96b7d03ea98b23c5ea74fa4f391732b3f50dd24b244423bec8393fa083ac2
SHA51246a6102c80f26b6b38120e4a2ed3c1548d412ef32ee27c657012f8e04b699b36167702c5824a75ba696ca3b74db136e453afae21fcdba526b1c20449bd4e3c25
-
Filesize
4KB
-
Filesize
4.3MB
-
Filesize
97.9MB
-
Filesize
97.9MB
-
Filesize
97.9MB
-
Filesize
97.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
97.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
236KB
-
Filesize
492KB
-
Filesize
236KB
-
Filesize
236KB