remcos | 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52

General

Target

Quotation.exe
Size

1.3MB
MD5

d9b34a5d20cce6b325ee7faa90256a06
SHA1

d71e29f815151a74205b14c371333d691ba9830e
SHA256

470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52
SHA512

34b081577999c0cf1265489f659e246bcd228673ff55a623f72992d5e5c85f2fcb781a57f82ccad47d3c509516dd8fd745c69e2ba5f92603e766e5ab8961a612
SSDEEP

24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aMSAweUh8tsg+4yNBb:iTvC/MTQYxsWR7aMSAEG68y/

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Drops startup file 1 IoCs

Processes:

chrome.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs chrome.exe
Executes dropped EXE 1 IoCs

Processes:

chrome.exe

pid process

2612 chrome.exe
Loads dropped DLL 1 IoCs

Processes:

Quotation.exe

pid process

2888 Quotation.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs	chrome.exe

pid	process
2612	chrome.exe

pid	process
2888	Quotation.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\directory\chrome.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chrome.exe

description pid process target process

PID 2612 set thread context of 2392 2612 chrome.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

chrome.exe

pid process

2612 chrome.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Quotation.exechrome.exe

pid process

2888 Quotation.exe
2888 Quotation.exe
2612 chrome.exe
2612 chrome.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Quotation.exechrome.exe

pid process

2888 Quotation.exe
2888 Quotation.exe
2612 chrome.exe
2612 chrome.exe

description	pid	process	target process
PID 2612 set thread context of 2392	2612	chrome.exe	svchost.exe

pid	process
2612	chrome.exe

pid	process
2888	Quotation.exe
2888	Quotation.exe
2612	chrome.exe
2612	chrome.exe

pid	process
2888	Quotation.exe
2888	Quotation.exe
2612	chrome.exe
2612	chrome.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Quotation.exechrome.exe

description	pid	process	target process
PID 2888 wrote to memory of 2612	2888	Quotation.exe	chrome.exe
PID 2888 wrote to memory of 2612	2888	Quotation.exe	chrome.exe
PID 2888 wrote to memory of 2612	2888	Quotation.exe	chrome.exe
PID 2888 wrote to memory of 2612	2888	Quotation.exe	chrome.exe
PID 2612 wrote to memory of 2392	2612	chrome.exe	svchost.exe
PID 2612 wrote to memory of 2392	2612	chrome.exe	svchost.exe
PID 2612 wrote to memory of 2392	2612	chrome.exe	svchost.exe
PID 2612 wrote to memory of 2392	2612	chrome.exe	svchost.exe
PID 2612 wrote to memory of 2392	2612	chrome.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888

C:\Users\Admin\AppData\Local\directory\chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
3⤵
PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ophiolatrous
Filesize
483KB

MD5
d1f9c2f8115082d19910822ccc9e5c10

SHA1
2cb10976a5deb529dcc372015dbdb6d492bd86f6

SHA256
26fdc3781343a64e156175aafa9038d5a3751bf175401c371adaf3f7c3d1e88f

SHA512
5f56c64805e3ea031de93c7b8ecf3b286a646b2de8f0a827a1e7296526d8b357ce62817ec8b1d63bd893fdc33be1c2f456fbbc0521fea136d220439a6053f01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pyogenesis
Filesize
29KB

MD5
5ed5fbdee0b73fbae50e27ac69ad7ae7

SHA1
283d4749e5729d7c5c3a51a6c15b1f7a47cf910f

SHA256
b049894d767c9e974b8e92f448acba5a2f86ed79dba36dbfffd2b9f2517e3881

SHA512
4034eda19cb86a9bb653210c9a746f4305f1c2b9656fa42dadadfb0fff119a09b73e9fa3d6656c7a73ba6e6cf267c0c56f55869c3c503ecccfd305d23ea0be8e

Download Submit
\Users\Admin\AppData\Local\directory\chrome.exe
Filesize
104.3MB

MD5
7f1892820672063392f514d3830cdb00

SHA1
892ac693e0a2e359ebaa5808ee83a1557839d949

SHA256
91f1702bd32483c273d2b572ac42d7906690695ca67c8ca37fc02284a07bf688

SHA512
018bacfa15e71440cfb5e37b572ce320d81b4b1760e10b0b801e6054cdb75e44069933b865a23f099f8e792f9854e1f1c6543259f91486be4d9b1c12892db54f

Download Submit
memory/2392-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2392-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2888-10-0x00000000001A0000-0x00000000001A4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing