remcos | 79e70809a85e291f9da3d391131208ce7645dd512eb6bb71811154b43da23222

General

Target

Quote.exe
Size

233KB
MD5

a96067cac28b1f5c3de4e1b6c7d0a402
SHA1

51c65c8ece4bfd5c7d1b09105440f3f02d3b14ca
SHA256

79e70809a85e291f9da3d391131208ce7645dd512eb6bb71811154b43da23222
SHA512

1627058a9a884965bce4ece1ccf03c24a849cd79fe883c923ae2eb56c8e0bbb730cf823e550c080685af1f906a38f2847a65dc8ed236181d97eee9ddcfc3f96e

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

103.89.88.238:4299

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Loads dropped DLL 2 IoCs

Processes:

Quote.exe

pid process

1096 Quote.exe
1096 Quote.exe

pid	process
1096	Quote.exe
1096	Quote.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Quote.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz = "C:\\Users\\Admin\\AppData\\Roaming\\abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstu"	Quote.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Quote.exe

description pid process target process

PID 1096 set thread context of 1040 1096 Quote.exe Quote.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Quote.exe

pid process

1096 Quote.exe
1096 Quote.exe
1096 Quote.exe
1096 Quote.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Quote.exe

pid process

1096 Quote.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Quote.exe

pid process

1040 Quote.exe

description	pid	process	target process
PID 1096 set thread context of 1040	1096	Quote.exe	Quote.exe

pid	process
1096	Quote.exe
1096	Quote.exe
1096	Quote.exe
1096	Quote.exe

pid	process
1096	Quote.exe

pid	process
1040	Quote.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Quote.exe

description	pid	process	target process
PID 1096 wrote to memory of 1040	1096	Quote.exe	Quote.exe
PID 1096 wrote to memory of 1040	1096	Quote.exe	Quote.exe
PID 1096 wrote to memory of 1040	1096	Quote.exe	Quote.exe
PID 1096 wrote to memory of 1040	1096	Quote.exe	Quote.exe
PID 1096 wrote to memory of 1040	1096	Quote.exe	Quote.exe

C:\Users\Admin\AppData\Local\Temp\Quote.exe
"C:\Users\Admin\AppData\Local\Temp\Quote.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\Quote.exe
  "C:\Users\Admin\AppData\Local\Temp\Quote.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nhop.dll

MD5
ff98a06930bd4c0a11500f2378f23ffa

SHA1
c25a3da1562f0dc0247140ff8636c88a843e9a66

SHA256
97cc714ecc6d201ff90e6947bedf9345dd9f0abffaa0687607d216f4567dfbd9

SHA512
8e33d253610a07c6603c6da9714bc18f2b9a6f3e229fd5d9873783ce842214689e3296bb37864720ca561a74b72beb5f7852ae3a732f4ec85c046646acd25916

Download Submit
\Users\Admin\AppData\Local\Temp\nss312F.tmp\System.dll

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/1040-5-0x0000000000413FA4-mapping.dmp

Download
memory/1040-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1096-2-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing