remcos | dd19e61d163a4f60de99634b57d4732a338efb745677654b55f1cb06d801b590

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2025, 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-07_4cdac7a47d6770fed9edd922b3cda0fb_amadey_black-basta_coinminer_luca-stealer_remcos_revil_smoke-loader.exe
Size

3.2MB
MD5

4cdac7a47d6770fed9edd922b3cda0fb
SHA1

b3ec5256a6166ae3cee6d42dbf39c20fe76244ec
SHA256

dd19e61d163a4f60de99634b57d4732a338efb745677654b55f1cb06d801b590
SHA512

f404374e49e7366ed81bbec6c21c223f3a8f03ef103fc164edaa3c1239c69f42bc31acf409d78abcb780ae242d3fb051aa9ce60e68fcc80cc347d1d641468362
SSDEEP

49152:12HbjNwKMq0RPkLDtVSwwXi5O3gPRA4Pz93/g6qRxF43ef7rCOBP:12HnmckkLl75O14duj43ef

Score

10^/10

remcos nhnotifsys discovery rat

Malware Config

Extracted

Family

remcos

Botnet

NhNotifSys

45.137.116.128:443

insdriveupdates-360.com:443

dominocloudplatform.com:443

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
3
connect_interval
3
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
SysComs.dat
keylog_flag
false
keylog_folder
NhNotifSys
keylog_path
%AppData%
mouse_option
false
mutex
NhNotifSys-5FH4NK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppHelp.lnk	2025-04-07_4cdac7a47d6770fed9edd922b3cda0fb_amadey_black-basta_coinminer_luca-stealer_remcos_revil_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-07_4cdac7a47d6770fed9edd922b3cda0fb_amadey_black-basta_coinminer_luca-stealer_remcos_revil_smoke-loader.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4628	2025-04-07_4cdac7a47d6770fed9edd922b3cda0fb_amadey_black-basta_coinminer_luca-stealer_remcos_revil_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-07_4cdac7a47d6770fed9edd922b3cda0fb_amadey_black-basta_coinminer_luca-stealer_remcos_revil_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-07_4cdac7a47d6770fed9edd922b3cda0fb_amadey_black-basta_coinminer_luca-stealer_remcos_revil_smoke-loader.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\NhNotifSys\SysComs.dat

Filesize
144B

MD5
39cf430bd95c7ef7c8998d4c69bd3118

SHA1
7505f73280aeee190444ce3cf9da20c88b5e3396

SHA256
7d04ff7373bf42f1e7142385d69c2fcf156a34699a19796acca5304c041bd080

SHA512
93c81229f4d3aaab8e72777123af1dffd22918a8344ac08b5cb2c8eb9565f5409b0d2818c134c9629e5bb95ca8e491becdd953fdec32468acc6596fd6df9b181

Download Submit
memory/4628-5-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4628-4-0x0000000075610000-0x000000007568A000-memory.dmp

Filesize
488KB

Download
memory/4628-1-0x0000000076F31000-0x0000000077051000-memory.dmp

Filesize
1.1MB

Download
memory/4628-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4628-9-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4628-10-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4628-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4628-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4628-2-0x0000000075CE0000-0x0000000075DDA000-memory.dmp

Filesize
1000KB

Download
memory/4628-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4628-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4628-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download