remcos | f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2025 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
Size

3.5MB
MD5

6626a89aa5cc47a20e9de81360327a3e
SHA1

c50e1f4cd7dc8cc23a3b73e0fb49464bbb6f2511
SHA256

f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7
SHA512

c3f2d9b5e7ddc03e8d1318f3a0faecf9e60938650203acf17032c3685ddb084e5d209e1f89d09886cc72eff9103ab907949df409a28504817453c85f9d28d170
SSDEEP

49152:fT2Wd4IbtCaIZ+SgnCxaC+1R5oWjhRSTp8Z2WTWw/10tte7:SW5QxajvOWM8UWTWw/IU

Score

10^/10

remcos fuck discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

fuck

republicadominica2025.ip-ddns.com:30202

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
rostad
mouse_option
false
mutex
iwebfiewbfihbewlfkm-WH4782
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NordicVPN = "C:\\Users\\Admin\\Documents\\NordVPNnetworkTAP\\Lang\\RemotePCPrinter.exe"	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4816	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4816	116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe	90
PID 116 wrote to memory of 4816	116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe	90
PID 116 wrote to memory of 4816	116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe	90
PID 116 wrote to memory of 4816	116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe	90
PID 116 wrote to memory of 4816	116	f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe	90

C:\Users\Admin\AppData\Local\Temp\f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
"C:\Users\Admin\AppData\Local\Temp\f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe
  "C:\Users\Admin\AppData\Local\Temp\f9c6e2f4c1be741b973d13b711fe68c71a2245c9908d0345724805f5eff1e2e7.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\rostad\logs.dat

Filesize
184B

MD5
85ffa2799b4ef9a6302f657c5ba8c48f

SHA1
9fb63e6540cbe8bafeddc9b9a8048fb54498238f

SHA256
67909b3bdf946bdb424d7e944d19e89438de5219510a48e3aeb7b044353251f1

SHA512
829a326740b78b6da755efec5e4e1abd47d0b90366162975c86459fc69e03525e6e76e6fafc124ef9a22fe3abc0046b7f39dce545d6405c0929b15eaa6070547

Download Submit
memory/116-0-0x0000000000F00000-0x0000000000F29000-memory.dmp

Filesize
164KB

Download
memory/116-18-0x0000000002760000-0x00000000027B8000-memory.dmp

Filesize
352KB

Download
memory/4816-14-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-13-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/4816-10-0x0000000000791000-0x0000000000792000-memory.dmp

Filesize
4KB

Download
memory/4816-9-0x00000000007C5000-0x00000000007C6000-memory.dmp

Filesize
4KB

Download
memory/4816-8-0x00000000007C6000-0x00000000007C7000-memory.dmp

Filesize
4KB

Download
memory/4816-7-0x00000000007CA000-0x00000000007CB000-memory.dmp

Filesize
4KB

Download
memory/4816-6-0x00000000007C8000-0x00000000007C9000-memory.dmp

Filesize
4KB

Download
memory/4816-5-0x00000000007C9000-0x00000000007CA000-memory.dmp

Filesize
4KB

Download
memory/4816-4-0x00000000007C7000-0x00000000007C8000-memory.dmp

Filesize
4KB

Download
memory/4816-3-0x00000000007C4000-0x00000000007C5000-memory.dmp

Filesize
4KB

Download
memory/4816-2-0x00000000007C3000-0x00000000007C4000-memory.dmp

Filesize
4KB

Download
memory/4816-12-0x0000000000793000-0x0000000000794000-memory.dmp

Filesize
4KB

Download
memory/4816-17-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-11-0x0000000000792000-0x0000000000793000-memory.dmp

Filesize
4KB

Download
memory/4816-19-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-24-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-25-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-1-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-30-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-31-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-37-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-38-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-43-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-44-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-49-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-51-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-56-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download
memory/4816-57-0x0000000000790000-0x0000000000810000-memory.dmp

Filesize
512KB

Download