Overview

overview

10

Static

static

77f25549a1...d2.exe

windows7_x64

10

77f25549a1...d2.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    77f25549a1a3f0bc29ca746125f0ad306418ee9699c1b7cd57c36d29488134d2

  • Size

    337KB

  • Sample

    201109-2rsy5sfvcx

  • MD5

    54be0c733c2f2ec0d17da28bd5f5d229

  • SHA1

    2018ec1b9b4040d304d76ae8e0cb66edc0c5ce50

  • SHA256

    77f25549a1a3f0bc29ca746125f0ad306418ee9699c1b7cd57c36d29488134d2

  • SHA512

    f259c6f49c680afa464b0b7c341ca90fc33b28fcb219cf8d75eb36f9592975973751bef476d7332e6d4c4473cd60779f5c5b62f41db83816079a2e5559578721

Score
10/10
remcoscoreentitypersistenceratrezer0

Malware Config

Extracted

Family

remcos

C2

servr.killifabuse1.xyz:8643

Targets

    • Target

      77f25549a1a3f0bc29ca746125f0ad306418ee9699c1b7cd57c36d29488134d2

    • Size

      337KB

    • MD5

      54be0c733c2f2ec0d17da28bd5f5d229

    • SHA1

      2018ec1b9b4040d304d76ae8e0cb66edc0c5ce50

    • SHA256

      77f25549a1a3f0bc29ca746125f0ad306418ee9699c1b7cd57c36d29488134d2

    • SHA512

      f259c6f49c680afa464b0b7c341ca90fc33b28fcb219cf8d75eb36f9592975973751bef476d7332e6d4c4473cd60779f5c5b62f41db83816079a2e5559578721

    Score
    10/10
    remcoscoreentitypersistenceratrezer0

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks