Overview

overview

10

Static

static

Invoice #7...46.exe

windows7_x64

10

Invoice #7...46.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice #756-77988-23989646.exe

  • Size

    438KB

  • Sample

    210112-xgdy262wq6

  • MD5

    80c06791542349507d8d49ee9177bee3

  • SHA1

    b15f778e61db3d629cd222fc2e144e4ae9040f14

  • SHA256

    9fad68bbaba3bcd69e3b8100eb5c035ea2caf59e0f9115e36667a62b2dce84bb

  • SHA512

    49c4b468d99c2b553b6edbc71e376908a3e1ef9598f4f577bbdac26f5c8f93b3d69dc3ff337006ddf5f2e23a961fe9c436183909f7551808eb924b8f56f88933

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

1.remcosagent.com:10001

Targets

    • Target

      Invoice #756-77988-23989646.exe

    • Size

      438KB

    • MD5

      80c06791542349507d8d49ee9177bee3

    • SHA1

      b15f778e61db3d629cd222fc2e144e4ae9040f14

    • SHA256

      9fad68bbaba3bcd69e3b8100eb5c035ea2caf59e0f9115e36667a62b2dce84bb

    • SHA512

      49c4b468d99c2b553b6edbc71e376908a3e1ef9598f4f577bbdac26f5c8f93b3d69dc3ff337006ddf5f2e23a961fe9c436183909f7551808eb924b8f56f88933

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks