Overview

overview

10

Static

static

10

z9ERDG51.exe

windows7_x64

10

z9ERDG51.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    z9ERDG51.exe
  • Size 92KB
  • Sample201125-325ac1dbax
  • SHA256 08f15e4acb5af5b3095304fbfd9370d33ea57a561da66bc1239477cdc6530dc3
  • MD5 SHA1 SHA512
Score
10/10
remcosevasionpersistencerat

Malware Config

Extracted

Family

  • remcos

C2

  • 185.185.3.40:2404

Targets

    • Target
      z9ERDG51.exe
    • Size 92KB
    • SHA256 08f15e4acb5af5b3095304fbfd9370d33ea57a561da66bc1239477cdc6530dc3
    • MD5 SHA1 SHA512
    Score
    10/10
    remcosevasionpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks