Overview

overview

10

Static

static

69aa574413...3a.exe

windows7_x64

10

69aa574413...3a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69aa57441342e6a7ff6b5b7cbf8cff3a.exe

  • Size

    1.3MB

  • Sample

    210119-d8c5m2dzpa

  • MD5

    69aa57441342e6a7ff6b5b7cbf8cff3a

  • SHA1

    be4c2676803beabbf4524a5eac674dbfa3cce0db

  • SHA256

    62af113dfd78cac402e87e1f70d7b3718258727b84ed947111269c1f874585da

  • SHA512

    1abf5eaf2b8078bce3da26dacdf132160e02692de15cf1801187ded19a4078aa23d0001432acb1d6c469c4582b48a48a92597ff76e456542b92ee7e410c3ab8c

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

wedsazxcvfghyuiokjhbnvfcdsaweyplmhbvrtud.ydns.eu:1996

Targets

    • Target

      69aa57441342e6a7ff6b5b7cbf8cff3a.exe

    • Size

      1.3MB

    • MD5

      69aa57441342e6a7ff6b5b7cbf8cff3a

    • SHA1

      be4c2676803beabbf4524a5eac674dbfa3cce0db

    • SHA256

      62af113dfd78cac402e87e1f70d7b3718258727b84ed947111269c1f874585da

    • SHA512

      1abf5eaf2b8078bce3da26dacdf132160e02692de15cf1801187ded19a4078aa23d0001432acb1d6c469c4582b48a48a92597ff76e456542b92ee7e410c3ab8c

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks