Edit tour
Windows
Analysis Report
202404294766578200.xlam.xlsx
Overview
General Information
Detection
Remcos
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Remcos
System process connects to network (likely due to code injection or exploit)
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Document exploit detected (process start blacklist hit)
Drops VBS files to the startup folder
Found API chain indicative of sandbox detection
Installs a global keyboard hook
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Searches for Windows Mail specific files
Shellcode detected
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected WebBrowserPassView password recovery tool
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to execute programs as a different user
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found decision node followed by non-executed suspicious APIs
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Office Equation Editor has been started
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Uncommon Svchost Parent Process
Stores files to the Windows start menu directory
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w7x64
- EXCEL.EXE (PID: 1216 cmdline:
"C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) - EQNEDT32.EXE (PID: 800 cmdline:
"C:\Progra m Files\Co mmon Files \Microsoft Shared\EQ UATION\EQN EDT32.EXE" -Embeddin g MD5: A87236E214F6D42A65F5DEDAC816AEC8) - YED.exe (PID: 652 cmdline:
C:\Users\u ser\AppDat a\Roaming\ YED.exe MD5: 9ABB13386C543EB5FEA7DEA95EB86D26) - Bactris.exe (PID: 3740 cmdline:
C:\Users\u ser\AppDat a\Roaming\ YED.exe MD5: A8004A594D5D55F5A5F5ABDBB8001FA9) - svchost.exe (PID: 3680 cmdline:
C:\Users\u ser\AppDat a\Roaming\ YED.exe MD5: 54A47F6B5E09A77E61649109C6A08866) - svchost.exe (PID: 3752 cmdline:
C:\Windows \SysWOW64\ svchost.ex e /stext " C:\Users\u ser\AppDat a\Local\Te mp\qcbxbnr r" MD5: 54A47F6B5E09A77E61649109C6A08866) - svchost.exe (PID: 3712 cmdline:
C:\Windows \SysWOW64\ svchost.ex e /stext " C:\Users\u ser\AppDat a\Local\Te mp\seghufc tinb" MD5: 54A47F6B5E09A77E61649109C6A08866) - svchost.exe (PID: 3672 cmdline:
C:\Windows \SysWOW64\ svchost.ex e /stext " C:\Users\u ser\AppDat a\Local\Te mp\dyuauqn mwvtskce" MD5: 54A47F6B5E09A77E61649109C6A08866)
- chrome.exe (PID: 1564 cmdline:
"C:\Progra m Files (x 86)\Google \Chrome\Ap plication\ chrome.exe " --start- maximized --single-a rgument ht tp:/// MD5: FFA2B8E17F645BCC20F0E0201FEF83ED) - chrome.exe (PID: 2960 cmdline:
"C:\Progra m Files (x 86)\Google \Chrome\Ap plication\ chrome.exe " --type=u tility --u tility-sub -type=netw ork.mojom. NetworkSer vice --lan g=en-US -- service-sa ndbox-type =none --mo jo-platfor m-channel- handle=136 4 --field- trial-hand le=1452,i, 1556898938 3610033621 ,860853916 9459799112 ,131072 -- disable-fe atures=Opt imizationG uideModelD ownloading ,Optimizat ionHints,O ptimizatio nHintsFetc hing,Optim izationTar getPredict ion /prefe tch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)
- chrome.exe (PID: 2068 cmdline:
"C:\Progra m Files (x 86)\Google \Chrome\Ap plication\ chrome.exe " --start- maximized --single-a rgument ht tp:/// MD5: FFA2B8E17F645BCC20F0E0201FEF83ED) - chrome.exe (PID: 3672 cmdline:
"C:\Progra m Files (x 86)\Google \Chrome\Ap plication\ chrome.exe " --type=u tility --u tility-sub -type=netw ork.mojom. NetworkSer vice --lan g=en-US -- service-sa ndbox-type =none --mo jo-platfor m-channel- handle=892 --field-t rial-handl e=1396,i,1 3358231411 772672971, 2555512376 125685792, 131072 --d isable-fea tures=Opti mizationGu ideModelDo wnloading, Optimizati onHints,Op timization HintsFetch ing,Optimi zationTarg etPredicti on /prefet ch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Remcos, RemcosRAT | Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity. |
{"Version": "4.9.4 Pro", "Host:Port:Password": "yuahdgbceja.sytes.net:2766:1", "Assigned name": "Grace-Host2024", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "AppData", "Copy file": "hua.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-E70NOS", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Enable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
INDICATOR_XML_LegacyDrawing_AutoLoad_Document | detects AutoLoad documents using LegacyDrawing | ditekSHen |
|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Remcos | Yara detected Remcos RAT | Joe Security | ||
JoeSecurity_UACBypassusingCMSTP | Yara detected UAC Bypass using CMSTP | Joe Security | ||
Windows_Trojan_Remcos_b296e965 | unknown | unknown |
| |
REMCOS_RAT_variants | unknown | unknown |
| |
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM | Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) | ditekSHen |
| |
Click to see the 13 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Remcos | Yara detected Remcos RAT | Joe Security | ||
JoeSecurity_UACBypassusingCMSTP | Yara detected UAC Bypass using CMSTP | Joe Security | ||
Windows_Trojan_Remcos_b296e965 | unknown | unknown |
| |
REMCOS_RAT_variants | unknown | unknown |
| |
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM | Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) | ditekSHen |
| |
Click to see the 15 entries |
Exploits |
---|
Source: | Author: Joe Security: |
Source: | Author: Joe Security: |
System Summary |
---|
Source: | Author: Max Altgelt (Nextron Systems): |
Source: | Author: Jason Lynch: |
Source: | Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: frack113: |
Source: | Author: vburov: |
Data Obfuscation |
---|
Source: | Author: Joe Security: |
Stealing of Sensitive Information |
---|
Source: | Author: Joe Security: |
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: |
Source: | URL Reputation: | ||
Source: | URL Reputation: | ||
Source: | Avira URL Cloud: |
Source: | Malware Configuration Extractor: |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Code function: | 17_2_00433837 |
Source: | Binary or memory string: | memstr_64e20cd0-e |
Exploits |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | Network connect: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Process created: |
Privilege Escalation |
---|
Source: | Code function: | 17_2_004074FD |
Source: | Directory created: | Jump to behavior | ||
Source: | Directory created: | Jump to behavior | ||
Source: | Directory created: | Jump to behavior |
Source: | File opened: | Jump to behavior |
Source: | Binary string: |
Source: | Code function: | 3_2_0027DBBE | |
Source: | Code function: | 3_2_0024C2A2 | |
Source: | Code function: | 3_2_002868EE | |
Source: | Code function: | 3_2_0028698F | |
Source: | Code function: | 3_2_0027D076 | |
Source: | Code function: | 3_2_0027D3A9 | |
Source: | Code function: | 3_2_00289642 | |
Source: | Code function: | 3_2_0028979D | |
Source: | Code function: | 16_2_010EDBBE | |
Source: | Code function: | 16_2_010BC2A2 | |
Source: | Code function: | 16_2_010F698F | |
Source: | Code function: | 16_2_010F68EE | |
Source: | Code function: | 16_2_010ED076 | |
Source: | Code function: | 16_2_010ED3A9 | |
Source: | Code function: | 16_2_010F979D | |
Source: | Code function: | 16_2_010F9642 | |
Source: | Code function: | 16_2_010F9B2B | |
Source: | Code function: | 16_2_010F5C97 | |
Source: | Code function: | 17_2_00409253 | |
Source: | Code function: | 17_2_0041C291 | |
Source: | Code function: | 17_2_0040C34D | |
Source: | Code function: | 17_2_00409665 | |
Source: | Code function: | 17_2_0044E879 | |
Source: | Code function: | 17_2_0040880C | |
Source: | Code function: | 17_2_0040783C | |
Source: | Code function: | 17_2_00419AF5 | |
Source: | Code function: | 17_2_0040BB30 | |
Source: | Code function: | 17_2_0040BD37 | |
Source: | Code function: | 17_2_100010F1 | |
Source: | Code function: | 17_2_10006580 |
Source: | Code function: | 17_2_00407C97 |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Software Vulnerabilities |
---|
Source: | Process created: |
Source: | Code function: | 2_2_0350055E | |
Source: | Code function: | 2_2_0350045F | |
Source: | Code function: | 2_2_035004F6 | |
Source: | Code function: | 2_2_035005E9 | |
Source: | Code function: | 2_2_03500496 | |
Source: | Code function: | 2_2_0350069C | |
Source: | Code function: | 2_2_035003D0 | |
Source: | Code function: | 2_2_03500254 | |
Source: | Code function: | 2_2_035002DF | |
Source: | Code function: | 2_2_03500542 | |
Source: | Code function: | 2_2_03500244 | |
Source: | Code function: | 2_2_03500249 | |
Source: | Code function: | 2_2_0350024B | |
Source: | Code function: | 2_2_035002CB | |
Source: | Code function: | 2_2_0350044C | |
Source: | Code function: | 2_2_0350034C | |
Source: | Code function: | 2_2_035002CE | |
Source: | Code function: | 2_2_035005CF | |
Source: | Code function: | 2_2_035002F5 | |
Source: | Code function: | 2_2_03500279 | |
Source: | Code function: | 2_2_035002EB | |
Source: | Code function: | 2_2_035003EC | |
Source: | Code function: | 2_2_0350026D | |
Source: | Code function: | 2_2_03500391 | |
Source: | Code function: | 2_2_03500292 | |
Source: | Code function: | 2_2_03500413 | |
Source: | Code function: | 2_2_0350031A | |
Source: | Code function: | 2_2_0350031F | |
Source: | Code function: | 2_2_03500289 | |
Source: | Code function: | 2_2_0350058F | |
Source: | Code function: | 2_2_0350028F | |
Source: | Code function: | 2_2_035003B7 | |
Source: | Code function: | 2_2_035006BC | |
Source: | Code function: | 2_2_0350033F | |
Source: | Code function: | 2_2_03500224 | |
Source: | Code function: | 2_2_035002A4 | |
Source: | Code function: | 2_2_035005AB |
Networking |
---|
Source: | Network Connect: | Jump to behavior | ||
Source: | Domain query: | |||
Source: | Domain query: | |||
Source: | Network Connect: | Jump to behavior |
Source: | URLs: |
Source: | TCP traffic: |
Source: | HTTP traffic detected: |