remcos | 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52

Resubmissions

03-04-2024 11:36

240403-nqx8yacf21 10

03-04-2024 11:33

240403-nnxjmace81 5

Analysis

max time kernel
300s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation.exe
Size

1.3MB
MD5

d9b34a5d20cce6b325ee7faa90256a06
SHA1

d71e29f815151a74205b14c371333d691ba9830e
SHA256

470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52
SHA512

34b081577999c0cf1265489f659e246bcd228673ff55a623f72992d5e5c85f2fcb781a57f82ccad47d3c509516dd8fd745c69e2ba5f92603e766e5ab8961a612
SSDEEP

24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aMSAweUh8tsg+4yNBb:iTvC/MTQYxsWR7aMSAEG68y/

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Drops startup file 1 IoCs

Processes:

chrome.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs chrome.exe
Executes dropped EXE 1 IoCs

Processes:

chrome.exe

pid process

3640 chrome.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs	chrome.exe

pid	process
3640	chrome.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\directory\chrome.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chrome.exe

description pid process target process

PID 3640 set thread context of 364 3640 chrome.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

chrome.exe

pid process

3640 chrome.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Quotation.exechrome.exe

pid process

3068 Quotation.exe
3068 Quotation.exe
3640 chrome.exe
3640 chrome.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Quotation.exechrome.exe

pid process

3068 Quotation.exe
3068 Quotation.exe
3640 chrome.exe
3640 chrome.exe

description	pid	process	target process
PID 3640 set thread context of 364	3640	chrome.exe	svchost.exe

pid	process
3640	chrome.exe

pid	process
3068	Quotation.exe
3068	Quotation.exe
3640	chrome.exe
3640	chrome.exe

pid	process
3068	Quotation.exe
3068	Quotation.exe
3640	chrome.exe
3640	chrome.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Quotation.exechrome.exe

description	pid	process	target process
PID 3068 wrote to memory of 3640	3068	Quotation.exe	chrome.exe
PID 3068 wrote to memory of 3640	3068	Quotation.exe	chrome.exe
PID 3068 wrote to memory of 3640	3068	Quotation.exe	chrome.exe
PID 3640 wrote to memory of 364	3640	chrome.exe	svchost.exe
PID 3640 wrote to memory of 364	3640	chrome.exe	svchost.exe
PID 3640 wrote to memory of 364	3640	chrome.exe	svchost.exe
PID 3640 wrote to memory of 364	3640	chrome.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\directory\chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
3⤵
PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ophiolatrous
Filesize
483KB

MD5
d1f9c2f8115082d19910822ccc9e5c10

SHA1
2cb10976a5deb529dcc372015dbdb6d492bd86f6

SHA256
26fdc3781343a64e156175aafa9038d5a3751bf175401c371adaf3f7c3d1e88f

SHA512
5f56c64805e3ea031de93c7b8ecf3b286a646b2de8f0a827a1e7296526d8b357ce62817ec8b1d63bd893fdc33be1c2f456fbbc0521fea136d220439a6053f01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pyogenesis
Filesize
29KB

MD5
5ed5fbdee0b73fbae50e27ac69ad7ae7

SHA1
283d4749e5729d7c5c3a51a6c15b1f7a47cf910f

SHA256
b049894d767c9e974b8e92f448acba5a2f86ed79dba36dbfffd2b9f2517e3881

SHA512
4034eda19cb86a9bb653210c9a746f4305f1c2b9656fa42dadadfb0fff119a09b73e9fa3d6656c7a73ba6e6cf267c0c56f55869c3c503ecccfd305d23ea0be8e

Download Submit
C:\Users\Admin\AppData\Local\directory\chrome.exe
Filesize
111.3MB

MD5
2c5d12c19dc637c325f6ca87ec59803f

SHA1
a5748984e148ba77f60d2bf20d8124e5edc67e75

SHA256
fc4c9329319967d1696b3a9c4b7df8fcc3275471b823c52bed95d9b5881e00b3

SHA512
22e52da43904630bba10c7a8836a91eb76539515beb93206486171a14db694a3f048711d57f1b211de304eec153c1b8d853bc0ebe3e3b593c8bc2edcbd5da03a

Download Submit
memory/364-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-53-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-66-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-74-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-76-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-77-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-79-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-80-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-81-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-82-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-84-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-85-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-86-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-87-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-89-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-90-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-91-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-92-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/364-93-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3068-10-0x0000000000E20000-0x0000000000E24000-memory.dmp

Filesize
16KB

Download