remcos | 8926954a67a71e7813cc50314a97d0235fa23601350d414d7e23f157e949724a

General

Target

HSBC_Copy.exe
Size

1011KB
MD5

420913d7cb5a155df809eb62f5586104
SHA1

8f8a19ecc918b653346860f7b73a6f9f5a78ad30
SHA256

8e28928a582c475fa995b9d487aad1d6b9997c07f4fdab1e449e25adc7cee0d0
SHA512

c7a2f9ccc42bfeccd8bf11d591a3d29d427c993e33d783f90538ff74af90a5cd37f45738a368ef6b8fafd21841e1c6cfcde51c2a8b88b5c8178250be1e5b95e3

Score

10^/10

remcos 10 rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

10

C2

abujafirms.com:2244

yokiri.com:2244

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-I2Z97W
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 3 IoCs

Processes:

QAZ223.exeQAZ223.exeQAZ223.exe

pid process

1616 QAZ223.exe
1740 QAZ223.exe
1564 QAZ223.exe
Drops startup file 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CV54JB.vbs notepad.exe
Loads dropped DLL 2 IoCs

Processes:

notepad.exe

pid process

1584 notepad.exe
1584 notepad.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

QAZ223.exe

description pid process target process

PID 1616 set thread context of 1740 1616 QAZ223.exe QAZ223.exe
NTFS ADS 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe:ZoneIdentifier notepad.exe

pid	process
1616	QAZ223.exe
1740	QAZ223.exe
1564	QAZ223.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CV54JB.vbs	notepad.exe

pid	process
1584	notepad.exe
1584	notepad.exe

description	pid	process	target process
PID 1616 set thread context of 1740	1616	QAZ223.exe	QAZ223.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe:ZoneIdentifier	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

HSBC_Copy.exeQAZ223.exeQAZ223.exe

pid	process
1268	HSBC_Copy.exe
1616	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe
1564	QAZ223.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

QAZ223.exe

pid process

1616 QAZ223.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

QAZ223.exe

pid process

1740 QAZ223.exe

pid	process
1616	QAZ223.exe

pid	process
1740	QAZ223.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

HSBC_Copy.exenotepad.exeQAZ223.exe

description	pid	process	target process
PID 1268 wrote to memory of 1584	1268	HSBC_Copy.exe	notepad.exe
PID 1268 wrote to memory of 1584	1268	HSBC_Copy.exe	notepad.exe
PID 1268 wrote to memory of 1584	1268	HSBC_Copy.exe	notepad.exe
PID 1268 wrote to memory of 1584	1268	HSBC_Copy.exe	notepad.exe
PID 1268 wrote to memory of 1584	1268	HSBC_Copy.exe	notepad.exe
PID 1268 wrote to memory of 1584	1268	HSBC_Copy.exe	notepad.exe
PID 1584 wrote to memory of 1616	1584	notepad.exe	QAZ223.exe
PID 1584 wrote to memory of 1616	1584	notepad.exe	QAZ223.exe
PID 1584 wrote to memory of 1616	1584	notepad.exe	QAZ223.exe
PID 1584 wrote to memory of 1616	1584	notepad.exe	QAZ223.exe
PID 1616 wrote to memory of 1740	1616	QAZ223.exe	QAZ223.exe
PID 1616 wrote to memory of 1740	1616	QAZ223.exe	QAZ223.exe
PID 1616 wrote to memory of 1740	1616	QAZ223.exe	QAZ223.exe
PID 1616 wrote to memory of 1740	1616	QAZ223.exe	QAZ223.exe
PID 1616 wrote to memory of 1564	1616	QAZ223.exe	QAZ223.exe
PID 1616 wrote to memory of 1564	1616	QAZ223.exe	QAZ223.exe
PID 1616 wrote to memory of 1564	1616	QAZ223.exe	QAZ223.exe
PID 1616 wrote to memory of 1564	1616	QAZ223.exe	QAZ223.exe

C:\Users\Admin\AppData\Local\Temp\HSBC_Copy.exe
"C:\Users\Admin\AppData\Local\Temp\HSBC_Copy.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
2⤵
- Drops startup file
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
"C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
"C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1740

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
"C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe" 2 1740 211069
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
420913d7cb5a155df809eb62f5586104

SHA1
8f8a19ecc918b653346860f7b73a6f9f5a78ad30

SHA256
8e28928a582c475fa995b9d487aad1d6b9997c07f4fdab1e449e25adc7cee0d0

SHA512
c7a2f9ccc42bfeccd8bf11d591a3d29d427c993e33d783f90538ff74af90a5cd37f45738a368ef6b8fafd21841e1c6cfcde51c2a8b88b5c8178250be1e5b95e3

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
420913d7cb5a155df809eb62f5586104

SHA1
8f8a19ecc918b653346860f7b73a6f9f5a78ad30

SHA256
8e28928a582c475fa995b9d487aad1d6b9997c07f4fdab1e449e25adc7cee0d0

SHA512
c7a2f9ccc42bfeccd8bf11d591a3d29d427c993e33d783f90538ff74af90a5cd37f45738a368ef6b8fafd21841e1c6cfcde51c2a8b88b5c8178250be1e5b95e3

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
420913d7cb5a155df809eb62f5586104

SHA1
8f8a19ecc918b653346860f7b73a6f9f5a78ad30

SHA256
8e28928a582c475fa995b9d487aad1d6b9997c07f4fdab1e449e25adc7cee0d0

SHA512
c7a2f9ccc42bfeccd8bf11d591a3d29d427c993e33d783f90538ff74af90a5cd37f45738a368ef6b8fafd21841e1c6cfcde51c2a8b88b5c8178250be1e5b95e3

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
420913d7cb5a155df809eb62f5586104

SHA1
8f8a19ecc918b653346860f7b73a6f9f5a78ad30

SHA256
8e28928a582c475fa995b9d487aad1d6b9997c07f4fdab1e449e25adc7cee0d0

SHA512
c7a2f9ccc42bfeccd8bf11d591a3d29d427c993e33d783f90538ff74af90a5cd37f45738a368ef6b8fafd21841e1c6cfcde51c2a8b88b5c8178250be1e5b95e3

Download Submit
\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
420913d7cb5a155df809eb62f5586104

SHA1
8f8a19ecc918b653346860f7b73a6f9f5a78ad30

SHA256
8e28928a582c475fa995b9d487aad1d6b9997c07f4fdab1e449e25adc7cee0d0

SHA512
c7a2f9ccc42bfeccd8bf11d591a3d29d427c993e33d783f90538ff74af90a5cd37f45738a368ef6b8fafd21841e1c6cfcde51c2a8b88b5c8178250be1e5b95e3

Download Submit
\Users\Admin\AppData\Roaming\AppData\QAZ223.exe
MD5
420913d7cb5a155df809eb62f5586104

SHA1
8f8a19ecc918b653346860f7b73a6f9f5a78ad30

SHA256
8e28928a582c475fa995b9d487aad1d6b9997c07f4fdab1e449e25adc7cee0d0

SHA512
c7a2f9ccc42bfeccd8bf11d591a3d29d427c993e33d783f90538ff74af90a5cd37f45738a368ef6b8fafd21841e1c6cfcde51c2a8b88b5c8178250be1e5b95e3

Download Submit
memory/1268-55-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1268-56-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/1268-57-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1268-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1564-74-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/1564-72-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1584-58-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1616-66-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1616-65-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1740-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing