remcos | a17b4a83e36a02f22d64cff10a32ddfa4756ad44334fa72079f6a11342b71e1b

Analysis

max time kernel
39s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 01:38

Target

Maryann 2023 Tax Organizer/g2m.dll
Size

150.0MB
MD5

3ceefa7bd30b2b5494c2cdb64342835c
SHA1

ef4cad7600788cc696cec53480dcfb67a5143adb
SHA256

e8eb6be89b47c2c5f4b61da460ae6c6d6bf150869624ad487df74b0d80351233
SHA512

a3f88fae400037427d3068d583317c08132ff936c21c3fa38a97afedb9b614302228903973ed3aa8b41fb266f5e1aa3c7550ce4b4653ea9d4b1c06a0c350880f
SSDEEP

786432:7UP7GCGO7b0Srkx/tC0SzIdSwh/WxbpNHQD3trzRp:7UP7GCG64Srkx1hSzYsHQD3t/R

Score

10^/10

Family

remcos

Botnet

RemoteHost

ogbatobanana.duckdns.org:4047

Attributes

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

regsvr32.exe

pid process

2980 regsvr32.exe

pid	process
2980	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1288 wrote to memory of 2980	1288	regsvr32.exe	regsvr32.exe
PID 1288 wrote to memory of 2980	1288	regsvr32.exe	regsvr32.exe
PID 1288 wrote to memory of 2980	1288	regsvr32.exe	regsvr32.exe
PID 2980 wrote to memory of 3608	2980	regsvr32.exe	cmd.exe
PID 2980 wrote to memory of 3608	2980	regsvr32.exe	cmd.exe
PID 2980 wrote to memory of 3608	2980	regsvr32.exe	cmd.exe
PID 2980 wrote to memory of 3464	2980	regsvr32.exe	regsvr32.exe
PID 2980 wrote to memory of 3464	2980	regsvr32.exe	regsvr32.exe
PID 2980 wrote to memory of 3464	2980	regsvr32.exe	regsvr32.exe
PID 2980 wrote to memory of 3464	2980	regsvr32.exe	regsvr32.exe
PID 2980 wrote to memory of 3464	2980	regsvr32.exe	regsvr32.exe
PID 2980 wrote to memory of 3464	2980	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Maryann 2023 Tax Organizer\g2m.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\VIVA_01.dll",EntryPoint /f & exit
3⤵
PID:3608

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\VIVA_01.dll",EntryPoint /f
4⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
1⤵
PID:4104

memory/2980-1-0x0000000010000000-0x0000000012DB3000-memory.dmp

Filesize
45.7MB

Download
memory/2980-2-0x0000000010000000-0x0000000012DB3000-memory.dmp

Filesize
45.7MB

Download
memory/2980-10-0x0000000010000000-0x0000000012DB3000-memory.dmp

Filesize
45.7MB

Download
memory/3464-9-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download
memory/3464-6-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download
memory/3464-8-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download
memory/3464-5-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download
memory/3464-3-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/3464-11-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download
memory/3464-12-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download
memory/3464-13-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download
memory/3464-15-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download
memory/3464-16-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download
memory/3464-17-0x0000000000A00000-0x0000000000A82000-memory.dmp

Filesize
520KB

Download