Overview

overview

10

Static

static

NEW PURCHA... .xlsx

windows7_x64

10

NEW PURCHA... .xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEW PURCHASE REQUIREMENT .xlsx

  • Size

    2.1MB

  • Sample

    210109-syfre9c8r6

  • MD5

    63fc87b0bb258315f3e229d16b933768

  • SHA1

    65fedd6ad7f14125a17b24831d66d31a57634ad5

  • SHA256

    5a814e460fc7723ec36e5f1451a7e0349bfce280c1f935b432378d666ce95044

  • SHA512

    a576575deb7143a202f1f066e3582b36a094dbd0ad6aeef0eaf8f6ee76562339627c1b5c38c38be54f32c56f7f49cf0554e524661fe8c7bede793e8f6ef70ba4

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017

Targets

    • Target

      NEW PURCHASE REQUIREMENT .xlsx

    • Size

      2.1MB

    • MD5

      63fc87b0bb258315f3e229d16b933768

    • SHA1

      65fedd6ad7f14125a17b24831d66d31a57634ad5

    • SHA256

      5a814e460fc7723ec36e5f1451a7e0349bfce280c1f935b432378d666ce95044

    • SHA512

      a576575deb7143a202f1f066e3582b36a094dbd0ad6aeef0eaf8f6ee76562339627c1b5c38c38be54f32c56f7f49cf0554e524661fe8c7bede793e8f6ef70ba4

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks