remcos | 1381969b2aafdbbcfa4cb72c29d112baaae2af42da167e694295a6a68e87c3ed

General

Target

2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
Size

487KB
MD5

28a0a5650d3944d2b538fb9c1a4ab5c4
SHA1

28731c664a21065c0a136950ec7ff4dcc62b9ce3
SHA256

1381969b2aafdbbcfa4cb72c29d112baaae2af42da167e694295a6a68e87c3ed
SHA512

4f49c2e79b08e1fa4a3e599f670dbb8ef034a0507b6de0c3e612dfcbe140f5bda8e9518efac83770680adeb0b170427bb91f28293fd353cfc223d2d2ca2a872a
SSDEEP

6144:KIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZ/FXvXc6AJ:K200OFp+G0imvHn3Cp6qyBP+YdsvZ/2

Score

10^/10

remcos whitedevil collection discovery rat

Malware Config

Extracted

Family

remcos

Botnet

whitedevil

C2

nextgenerationzynkobsupporterlovesgood.duckdns.org:14645

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-PSWF63
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 9 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/4812-11-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/4668-14-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/4564-15-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/4564-12-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/4668-10-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/4564-19-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/4812-13-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/4668-20-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/4812-22-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/4564-15-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/4564-12-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/4564-19-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/4812-11-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/4812-13-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/4812-22-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	recover.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2848 set thread context of 4812	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	94
PID 2848 set thread context of 4564	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95
PID 2848 set thread context of 4668	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4812	recover.exe
4812	recover.exe
4668	recover.exe
4668	recover.exe
4812	recover.exe
4812	recover.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4668	recover.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 4812	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	94
PID 2848 wrote to memory of 4812	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	94
PID 2848 wrote to memory of 4812	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	94
PID 2848 wrote to memory of 4812	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	94
PID 2848 wrote to memory of 4564	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95
PID 2848 wrote to memory of 4564	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95
PID 2848 wrote to memory of 4564	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95
PID 2848 wrote to memory of 4564	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	95
PID 2848 wrote to memory of 4668	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	96
PID 2848 wrote to memory of 4668	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	96
PID 2848 wrote to memory of 4668	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	96
PID 2848 wrote to memory of 4668	2848	2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe	96

C:\Users\Admin\AppData\Local\Temp\2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-05_28a0a5650d3944d2b538fb9c1a4ab5c4_amadey_black-basta_cobalt-strike_luca-stealer_remcos.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\recover.exe
  C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\rtzwsfqbpbmgjnaojogyjqstncebrurir"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Windows\SysWOW64\recover.exe
  C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\bnfpt"
  2⤵
  - Accesses Microsoft Outlook accounts
  - System Location Discovery: System Language Discovery
  PID:4564
- C:\Windows\SysWOW64\recover.exe
  C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\mpkiuqlw"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rtzwsfqbpbmgjnaojogyjqstncebrurir

Filesize
4KB

MD5
183a484857c42abff35dc9debdbee6dd

SHA1
7abea0ad337f4bfe11f70ed6ec55e8d19918bed7

SHA256
57366816fad3797dd06c762ebe5b569f13e518f1b95d200395ced430d46a3507

SHA512
9f4b1d43338e7dc29de5bbc97b5f83475e69bdcda035493a2f10ce49b93ba51c082774799eed4840a28264023d0918fd496763a4c7bf153d97bb6ed524f97406

Download Submit
memory/2848-30-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2848-28-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2848-27-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2848-29-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2848-24-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4564-15-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4564-19-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4564-7-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4564-2-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4564-12-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4668-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4668-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4668-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4668-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4668-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4812-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4812-1-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4812-11-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4812-8-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4812-22-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing