General

  • Target

    QUOTATION 114317.exe

  • Size

    1.6MB

  • Sample

    210118-gb8vlzm5aj

  • MD5

    9ab843b4c2b4edc48edee828a2869c2f

  • SHA1

    1b59b91da56ea773bd54ffb10844b58ca9e1de37

  • SHA256

    4327efeb833e3daa98a5f1cac94fa6d1c858fd25fb0c416f0880d142a62955a5

  • SHA512

    7504b57656fdaf867e1e5a9ed3d93dcb0cfc2d02de96d1725b37f57aa43c3ff3e4d8efdb5646ffe03d62a0d85ba35d10cc0923171b4b4a0bc1eb4352710fe85a

Score
10/10

Malware Config

Extracted

Family

remcos

C2

eileenwmsscm.duckdns.org:2558

Targets

    • Target

      QUOTATION 114317.exe

    • Size

      1.6MB

    • MD5

      9ab843b4c2b4edc48edee828a2869c2f

    • SHA1

      1b59b91da56ea773bd54ffb10844b58ca9e1de37

    • SHA256

      4327efeb833e3daa98a5f1cac94fa6d1c858fd25fb0c416f0880d142a62955a5

    • SHA512

      7504b57656fdaf867e1e5a9ed3d93dcb0cfc2d02de96d1725b37f57aa43c3ff3e4d8efdb5646ffe03d62a0d85ba35d10cc0923171b4b4a0bc1eb4352710fe85a

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks