Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 22:24
General
-
Target
Application Form.exe
-
Size
620KB
-
MD5
ea431733561c16e385bedd8478522598
-
SHA1
b56c6bf369510cad2dec8356b330a96d6a060bab
-
SHA256
9888381eb68d98f0581ab81845f2fc9e15af6ba1193a131bdf60497e3a3d1247
-
SHA512
bcc536bb79caf6e43ba661669e8e166b94a7f78a5b094a11f851876c889d573b5801dd655240be163ea7a2f56f6fefb5698e64f9791dff0ce08126eb7760f9be
Score
10/10
Malware Config
Extracted
Family
remcos
C2
Toolz.mywire.org:4499
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Application Form.exe"C:\Users\Admin\AppData\Local\Temp\Application Form.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Application Form.exe"C:\Users\Admin\AppData\Local\Temp\Application Form.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
-
-
Filesize
132KB