remcos | 11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346

General

Target

11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe
Size

1.1MB
MD5

8e9211eea2ba6f1b345b696b10f9518a
SHA1

0d2cb42cee5bc56d6a6fab077e950fefd0af9c43
SHA256

11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346
SHA512

c263aa2bbdd5394eab6d62a8f54ada0f3565ab154cbe754012f92580f5a5f24d347b938810986eaf160d4dc27726ab3b0104aba3ee7b87c0fea6f547c79c349f
SSDEEP

24576:gMaSSKy2/SPNZOgqiaanW8I3lwVvPIVVR+8hV:gRQuOgqiauSwVOVR+0

Score

10^/10

remcos remotehost discovery rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

www.kposlifestyle.design:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
edefdefffff
mouse_option
false
mutex
Rmc-OH1QS4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2112 set thread context of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2344	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30
PID 2112 wrote to memory of 2344	2112	11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe	30

C:\Users\Admin\AppData\Local\Temp\11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe
"C:\Users\Admin\AppData\Local\Temp\11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe
  "C:\Users\Admin\AppData\Local\Temp\11a4eadb74837d9fdc0f052302016abed805674c458529523101ced2ccaf4346.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\edefdefffff\logs.dat

Filesize
124B

MD5
b80593d6702849dc6e30401324a1ee0b

SHA1
dfdcafc0b20ea32fd271642154ea038dc6af06aa

SHA256
122e6dfdff08e72f8ce18b37e81f649ad7542dcaeaeec37b2f19f2af85c7c4ba

SHA512
009217ff08f7fd1296430931e751a5c15bfdf48a4c512511b584bf7c38b63c69afe255fbcac397df8e1c560617c0c04c623b69326e4b6649a559219ab8cbe48d

Download Submit
memory/2112-0-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x0000000000F30000-0x0000000001058000-memory.dmp

Filesize
1.2MB

Download
memory/2112-2-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-3-0x0000000004930000-0x00000000049DC000-memory.dmp

Filesize
688KB

Download
memory/2112-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2112-37-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-36-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/2344-22-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-32-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-21-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2344-15-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-13-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-9-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-7-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-5-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-27-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-29-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-28-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-30-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-26-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-34-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-33-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-25-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-19-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-39-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-12-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-44-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-45-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-52-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-53-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-60-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-61-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-68-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2344-69-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing