remcos | 1381969b2aafdbbcfa4cb72c29d112baaae2af42da167e694295a6a68e87c3ed

General

Target

2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
Size

487KB
MD5

28a0a5650d3944d2b538fb9c1a4ab5c4
SHA1

28731c664a21065c0a136950ec7ff4dcc62b9ce3
SHA256

1381969b2aafdbbcfa4cb72c29d112baaae2af42da167e694295a6a68e87c3ed
SHA512

4f49c2e79b08e1fa4a3e599f670dbb8ef034a0507b6de0c3e612dfcbe140f5bda8e9518efac83770680adeb0b170427bb91f28293fd353cfc223d2d2ca2a872a
SSDEEP

6144:KIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZ/FXvXc6AJ:K200OFp+G0imvHn3Cp6qyBP+YdsvZ/2

Score

10^/10

remcos whitedevil collection discovery rat

Malware Config

Extracted

Family

remcos

Botnet

whitedevil

C2

nextgenerationzynkobsupporterlovesgood.duckdns.org:14645

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-PSWF63
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 8 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/4632-10-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/4612-15-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/4632-20-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/4624-19-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/4624-13-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/4632-12-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/4624-11-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/4612-22-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/4632-10-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/4632-20-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/4632-12-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/4612-15-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/4612-22-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	recover.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3212 set thread context of 4612	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	92
PID 3212 set thread context of 4632	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	93
PID 3212 set thread context of 4624	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4624	recover.exe
4624	recover.exe
4612	recover.exe
4612	recover.exe
4612	recover.exe
4612	recover.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	recover.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4612	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	92
PID 3212 wrote to memory of 4612	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	92
PID 3212 wrote to memory of 4612	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	92
PID 3212 wrote to memory of 4612	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	92
PID 3212 wrote to memory of 4632	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	93
PID 3212 wrote to memory of 4632	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	93
PID 3212 wrote to memory of 4632	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	93
PID 3212 wrote to memory of 4632	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	93
PID 3212 wrote to memory of 4652	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	94
PID 3212 wrote to memory of 4652	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	94
PID 3212 wrote to memory of 4652	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	94
PID 3212 wrote to memory of 4624	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95
PID 3212 wrote to memory of 4624	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95
PID 3212 wrote to memory of 4624	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95
PID 3212 wrote to memory of 4624	3212	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95

C:\Users\Admin\AppData\Local\Temp\2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\recover.exe
  C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\wrhvmagooscrqghfmaltjjwzmetzrje"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Windows\SysWOW64\recover.exe
  C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\htuo"
  2⤵
  - Accesses Microsoft Outlook accounts
  - System Location Discovery: System Language Discovery
  PID:4632
- C:\Windows\SysWOW64\recover.exe
  C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\joahglb"
  2⤵
  PID:4652
- C:\Windows\SysWOW64\recover.exe
  C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\joahglb"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wrhvmagooscrqghfmaltjjwzmetzrje

Filesize
4KB

MD5
05a640e15ef8a6cd5d8db4633bfd2df3

SHA1
23771918cb286dd2ca98c0cc1664931e64cc33c8

SHA256
5b8be3e1fe8438ab1032b5914b5f5b8f544defc91213c6ef3f307b44d2a1951c

SHA512
27d198ecea0bbc12a48ce27c8dbd8a9a445248956623cefd501562cf00162a662e40f020a7276f1f870f324617f419342de9384b71664eea4778866b8bcfd616

Download Submit
memory/3212-32-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3212-31-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3212-24-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3212-27-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3212-29-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3212-30-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3212-28-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4612-14-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4612-1-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4612-15-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4612-5-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4612-22-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4624-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4624-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4624-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4624-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4624-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4632-3-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4632-12-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4632-20-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4632-6-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4632-10-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing