Overview

overview

10

Static

static

DOC2021040...DF.exe

windows7_x64

10

DOC2021040...DF.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DOC20210403A266NR5282RBL20266178278_PDF.exe

  • Size

    845KB

  • Sample

    210408-6rsf1m9alj

  • MD5

    7ccc15217d4c2a598b5b04ec928f32a4

  • SHA1

    c3828f550527c84fa7150ae944167d3ee9ca726b

  • SHA256

    8dc3da77d945f8df3206906bcf76f1096e4db213a9b7b5911d7f0e8eaf3c8b67

  • SHA512

    6911909546c988ea561d19e1bb8dd0afe47690cc81cb62dca97eadf7be5bb11d1c6bc6caa27368f2d0f9461c618f10728a36ca59b43f8bf8f12d03743a1876c1

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

olorunwa.duckdns.org:6548

Targets

    • Target

      DOC20210403A266NR5282RBL20266178278_PDF.exe

    • Size

      845KB

    • MD5

      7ccc15217d4c2a598b5b04ec928f32a4

    • SHA1

      c3828f550527c84fa7150ae944167d3ee9ca726b

    • SHA256

      8dc3da77d945f8df3206906bcf76f1096e4db213a9b7b5911d7f0e8eaf3c8b67

    • SHA512

      6911909546c988ea561d19e1bb8dd0afe47690cc81cb62dca97eadf7be5bb11d1c6bc6caa27368f2d0f9461c618f10728a36ca59b43f8bf8f12d03743a1876c1

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks