remcos | 192a4af0675a942cf3ab49f8b8ac7a6508b1c09fcb90d2003611b67485201b24

General

Target

Quotation.exe
Size

1.3MB
MD5

d9b34a5d20cce6b325ee7faa90256a06
SHA1

d71e29f815151a74205b14c371333d691ba9830e
SHA256

470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52
SHA512

34b081577999c0cf1265489f659e246bcd228673ff55a623f72992d5e5c85f2fcb781a57f82ccad47d3c509516dd8fd745c69e2ba5f92603e766e5ab8961a612
SSDEEP

24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aMSAweUh8tsg+4yNBb:iTvC/MTQYxsWR7aMSAEG68y/

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Drops startup file 1 IoCs

Processes:

chrome.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs chrome.exe
Executes dropped EXE 1 IoCs

Processes:

chrome.exe

pid process

2188 chrome.exe
Loads dropped DLL 1 IoCs

Processes:

Quotation.exe

pid process

2020 Quotation.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs	chrome.exe

pid	process
2188	chrome.exe

pid	process
2020	Quotation.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\directory\chrome.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chrome.exe

description pid process target process

PID 2188 set thread context of 2780 2188 chrome.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

chrome.exe

pid process

2188 chrome.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Quotation.exechrome.exe

pid process

2020 Quotation.exe
2020 Quotation.exe
2188 chrome.exe
2188 chrome.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Quotation.exechrome.exe

pid process

2020 Quotation.exe
2020 Quotation.exe
2188 chrome.exe
2188 chrome.exe

description	pid	process	target process
PID 2188 set thread context of 2780	2188	chrome.exe	svchost.exe

pid	process
2188	chrome.exe

pid	process
2020	Quotation.exe
2020	Quotation.exe
2188	chrome.exe
2188	chrome.exe

pid	process
2020	Quotation.exe
2020	Quotation.exe
2188	chrome.exe
2188	chrome.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Quotation.exechrome.exe

description	pid	process	target process
PID 2020 wrote to memory of 2188	2020	Quotation.exe	chrome.exe
PID 2020 wrote to memory of 2188	2020	Quotation.exe	chrome.exe
PID 2020 wrote to memory of 2188	2020	Quotation.exe	chrome.exe
PID 2020 wrote to memory of 2188	2020	Quotation.exe	chrome.exe
PID 2188 wrote to memory of 2780	2188	chrome.exe	svchost.exe
PID 2188 wrote to memory of 2780	2188	chrome.exe	svchost.exe
PID 2188 wrote to memory of 2780	2188	chrome.exe	svchost.exe
PID 2188 wrote to memory of 2780	2188	chrome.exe	svchost.exe
PID 2188 wrote to memory of 2780	2188	chrome.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\directory\chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
3⤵
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ophiolatrous
Filesize
483KB

MD5
d1f9c2f8115082d19910822ccc9e5c10

SHA1
2cb10976a5deb529dcc372015dbdb6d492bd86f6

SHA256
26fdc3781343a64e156175aafa9038d5a3751bf175401c371adaf3f7c3d1e88f

SHA512
5f56c64805e3ea031de93c7b8ecf3b286a646b2de8f0a827a1e7296526d8b357ce62817ec8b1d63bd893fdc33be1c2f456fbbc0521fea136d220439a6053f01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pyogenesis
Filesize
29KB

MD5
5ed5fbdee0b73fbae50e27ac69ad7ae7

SHA1
283d4749e5729d7c5c3a51a6c15b1f7a47cf910f

SHA256
b049894d767c9e974b8e92f448acba5a2f86ed79dba36dbfffd2b9f2517e3881

SHA512
4034eda19cb86a9bb653210c9a746f4305f1c2b9656fa42dadadfb0fff119a09b73e9fa3d6656c7a73ba6e6cf267c0c56f55869c3c503ecccfd305d23ea0be8e

Download Submit
\Users\Admin\AppData\Local\directory\chrome.exe
Filesize
107.3MB

MD5
789790b0ef43ea44a3d7789d9bd9a21f

SHA1
51fafc03462ab5a5f3aa9878aa9c8ae99328e596

SHA256
3690027a8de79b5e5a5448c17e11c8b6bd203aa70e19ae68691c7346b6ad2b52

SHA512
a4d3b5b3fd5af1abf2907255db880438d00324470e9dab80405f132a4095ddfd6befe3b3604ab304b5690fb514782629b6ae035e0f111bb43a22bc76a01a48bd

Download Submit
memory/2020-10-0x00000000005F0000-0x00000000005F4000-memory.dmp

Filesize
16KB

Download
memory/2780-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2780-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing