Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2024 09:01

General

  • Target

    Quote.exe

  • Size

    878KB

  • MD5

    80cfda135a7c57063e8eb5a38660ae07

  • SHA1

    212fdff074e62dae3a52a771fc86fdf39d0c0104

  • SHA256

    e18f7d1e4381c956556250ca9be9e97377b602ebd0ab96b1c092682596a90fbf

  • SHA512

    e3132b360e6e56f6e1e87530c88cb5594052d29fc13fc3f7b2777b81bf02c0c22fbb8cf81cbd55aae1551d4a59ffb9c4e69ba31a79499211c1de8703757ab691

  • SSDEEP

    24576:zcB82Da9a3eu75lyvIgVIus7NZ4dUpoC1n1:469aOu736Ig0N/F11

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

www.projectusf.com:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    gfh

  • mouse_option

    false

  • mutex

    Rmc-J91LMC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quote.exe
    "C:\Users\Admin\AppData\Local\Temp\Quote.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uEOzlLKIrzO.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:428
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uEOzlLKIrzO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA122.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1708
    • C:\Users\Admin\AppData\Local\Temp\Quote.exe
      "C:\Users\Admin\AppData\Local\Temp\Quote.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\gfh\logs.dat

    Filesize

    144B

    MD5

    4d7bcdd59e9d89f31179612cbf3e3b13

    SHA1

    7b5e5a4fadb8ef7c8e7e4259a33d43c37288258c

    SHA256

    f486d1e58a9eb0762ca0ebce553bf33e01270ceb3af1beae0f5ed65b3ab03bcc

    SHA512

    7422e5eb322da25227520b9699da3afc16874c2f9e9818a3b925486725664fb3c472da81770e7af7fb18d51eb8e68b9981d5bc62af8886d1c23e43505cf72149

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c0bvzliq.luj.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpA122.tmp

    Filesize

    1KB

    MD5

    63adcac1231a3a69cc2f788438e16e1b

    SHA1

    051123f98e69b323b86e76bd5b29da9b3724981e

    SHA256

    220a1a7e3ac7853a6d27727e5f5f06a7770305c8c3e0ac6f8bdf66772cd39207

    SHA512

    e556712b01653a1b4a36ea81b02faca0c16967518e07e6b72d560836bd9ec0abe1f2394bf80d92eab827a5a42993486e16b6f1c7c1d3b9e9853ce4ff7f3eaf79

  • memory/232-80-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-127-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-155-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-154-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-81-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-152-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-151-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-149-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-148-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-146-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-145-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-84-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-144-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-36-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-35-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-38-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-43-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-42-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-39-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-142-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-141-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-45-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-140-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-138-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-137-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-135-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-134-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-132-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-131-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-130-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-128-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-101-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-126-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-124-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-123-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-121-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-120-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-118-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-85-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-117-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-116-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-114-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-111-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-70-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-110-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-74-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-76-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-77-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-79-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-108-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-107-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-105-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-104-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-103-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-87-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-89-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-90-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-91-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-93-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-94-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-96-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-97-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-99-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/232-100-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/428-65-0x0000000007E20000-0x0000000007E31000-memory.dmp

    Filesize

    68KB

  • memory/428-19-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/428-20-0x0000000005920000-0x0000000005942000-memory.dmp

    Filesize

    136KB

  • memory/428-22-0x0000000006120000-0x0000000006186000-memory.dmp

    Filesize

    408KB

  • memory/428-24-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/428-17-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/428-73-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/428-69-0x0000000007F40000-0x0000000007F48000-memory.dmp

    Filesize

    32KB

  • memory/428-68-0x0000000007F60000-0x0000000007F7A000-memory.dmp

    Filesize

    104KB

  • memory/428-67-0x0000000007E60000-0x0000000007E74000-memory.dmp

    Filesize

    80KB

  • memory/428-66-0x0000000007E50000-0x0000000007E5E000-memory.dmp

    Filesize

    56KB

  • memory/428-64-0x0000000007EA0000-0x0000000007F36000-memory.dmp

    Filesize

    600KB

  • memory/428-63-0x0000000007C90000-0x0000000007C9A000-memory.dmp

    Filesize

    40KB

  • memory/428-62-0x0000000007C20000-0x0000000007C3A000-memory.dmp

    Filesize

    104KB

  • memory/428-61-0x0000000008260000-0x00000000088DA000-memory.dmp

    Filesize

    6.5MB

  • memory/428-60-0x0000000007900000-0x00000000079A3000-memory.dmp

    Filesize

    652KB

  • memory/428-49-0x000000006FA00000-0x000000006FA4C000-memory.dmp

    Filesize

    304KB

  • memory/428-59-0x0000000006F40000-0x0000000006F5E000-memory.dmp

    Filesize

    120KB

  • memory/428-48-0x0000000006ED0000-0x0000000006F02000-memory.dmp

    Filesize

    200KB

  • memory/428-16-0x0000000005340000-0x0000000005376000-memory.dmp

    Filesize

    216KB

  • memory/428-23-0x0000000006280000-0x00000000062E6000-memory.dmp

    Filesize

    408KB

  • memory/428-18-0x0000000005AF0000-0x0000000006118000-memory.dmp

    Filesize

    6.2MB

  • memory/428-32-0x00000000062F0000-0x0000000006644000-memory.dmp

    Filesize

    3.3MB

  • memory/428-44-0x0000000006900000-0x000000000691E000-memory.dmp

    Filesize

    120KB

  • memory/428-46-0x0000000006E70000-0x0000000006EBC000-memory.dmp

    Filesize

    304KB

  • memory/3116-7-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/3116-8-0x00000000750DE000-0x00000000750DF000-memory.dmp

    Filesize

    4KB

  • memory/3116-9-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/3116-10-0x0000000006810000-0x00000000068D0000-memory.dmp

    Filesize

    768KB

  • memory/3116-11-0x0000000008EE0000-0x0000000008F7C000-memory.dmp

    Filesize

    624KB

  • memory/3116-47-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/3116-2-0x0000000005340000-0x00000000058E4000-memory.dmp

    Filesize

    5.6MB

  • memory/3116-6-0x0000000006360000-0x000000000643A000-memory.dmp

    Filesize

    872KB

  • memory/3116-5-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/3116-4-0x0000000004C60000-0x0000000004C6A000-memory.dmp

    Filesize

    40KB

  • memory/3116-3-0x0000000004C80000-0x0000000004D12000-memory.dmp

    Filesize

    584KB

  • memory/3116-1-0x0000000000180000-0x0000000000262000-memory.dmp

    Filesize

    904KB

  • memory/3116-0-0x00000000750DE000-0x00000000750DF000-memory.dmp

    Filesize

    4KB