remcos | dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b

Analysis

max time kernel
166s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/PartiShikari.dll
Size

50KB
MD5

8aec2b9bf7b0156601b5738445c89afb
SHA1

72a3cf230083d1b882181bda3320ee5592a058d2
SHA256

e288f1292df61e692e2ba9f2a163bcaa620403b30fad40155c37edc9c9e53f76
SHA512

a92939475c2d0ac2331428d42628fc035ef98b3bb7ff9c154d99b441a38e11419de74fea0b07765de695dc02f0610ac9aba2ce7f82d500703b87f5f1183fe9ba
SSDEEP

1536:dJOsygYsjOO8ziIJJNAB/qepudoVoD3Qu3IE:7s2IJM

Score

10^/10

remcos treintayocho rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

TREINTAYOCHO

treintayochorem.duckdns.org:1010

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-H7ZOSI
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Drops file in Windows directory 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Windows\Tasks\msfeedssync.job notepad.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

5088 rundll32.exe
5088 rundll32.exe
5088 rundll32.exe
5088 rundll32.exe
5088 rundll32.exe
5088 rundll32.exe
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

rundll32.exe

pid process

5088 rundll32.exe
5088 rundll32.exe
5088 rundll32.exe
5088 rundll32.exe
5088 rundll32.exe
5088 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

notepad.exe

pid process

1636 notepad.exe

description	ioc	process
File created	C:\Windows\Tasks\msfeedssync.job	notepad.exe

pid	process
5088	rundll32.exe
5088	rundll32.exe
5088	rundll32.exe
5088	rundll32.exe
5088	rundll32.exe
5088	rundll32.exe

pid	process
5088	rundll32.exe
5088	rundll32.exe
5088	rundll32.exe
5088	rundll32.exe
5088	rundll32.exe
5088	rundll32.exe

pid	process
1636	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1900 wrote to memory of 5088	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 5088	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 5088	1900	rundll32.exe	rundll32.exe
PID 5088 wrote to memory of 5028	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 5028	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 5028	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 5028	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 5028	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 5028	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 5028	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 5028	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 5028	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4808	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4808	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4808	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4808	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4808	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4808	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4808	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4808	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4808	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4620	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4620	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4620	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4620	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4620	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4620	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4620	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4620	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 4620	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1404	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1404	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1404	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1404	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1404	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1404	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1404	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1404	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1404	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 2024	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 2024	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 2024	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 2024	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 2024	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 2024	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 2024	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 2024	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 2024	5088	rundll32.exe	cmd.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe
PID 5088 wrote to memory of 1636	5088	rundll32.exe	notepad.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\PartiShikari.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\PartiShikari.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:4808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:4620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:1404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:2024

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Filesize
74B

MD5
bd390322d86739b0572f0c4341ce9b1a

SHA1
2cce2128cd9f54639e60928060709cc3f13d08da

SHA256
7fdb5d06505a55fb098f9b17b09070c1e389068ab2eaa9a14a91c627855e7603

SHA512
4645f3689edb6a82a5d1493c98fab55eaff48ac46b5aa6d824bc64f108c5c771b7445412cc3d7ed9fe85dac0fa75375e03738379811ef6be88d7da99bec8835c

Download Submit
memory/1636-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1636-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1636-11-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

Filesize
2.0MB

Download
memory/1636-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1636-18-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/1636-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1636-24-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1636-27-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5088-2-0x0000000074E10000-0x0000000074E73000-memory.dmp

Filesize
396KB

Download
memory/5088-3-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

Filesize
2.0MB

Download
memory/5088-9-0x00000000748E0000-0x00000000749A8000-memory.dmp

Filesize
800KB

Download
memory/5088-0-0x0000000001240000-0x0000000001242000-memory.dmp

Filesize
8KB

Download
memory/5088-1-0x00000000748E0000-0x00000000749A8000-memory.dmp

Filesize
800KB

Download