Overview

overview

10

Static

static

ADJUNTO_EX...df.exe

windows7_x64

10

ADJUNTO_EX...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ADJUNTO_EXTRACTO_57971132761620070018881_09935417206929246064486_21739530852328700789183845_619471746722927151121122_pdf

  • Size

    179KB

  • Sample

    210423-jwgg6deym6

  • MD5

    f18ecb4ec01c8696b450b53e255f8e32

  • SHA1

    18e24ceb9004c164db0d204d9ca513b5a64060fa

  • SHA256

    b805f68139469a793d97d7082a7d46a5eedcea8fa39676fd4ce557dae2725fff

  • SHA512

    59f5c4616b17aaeba753318fcffacba71dc76bcc599665e31a50e7d31026ed2edc598bd285b1de9e19a09e9a6987318be3f17cee827a7b7ce2a89e6385d8f36d

Score
10/10
remcosevasionpersistencerattrojan

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:3521

Targets

    • Target

      ADJUNTO_EXTRACTO_57971132761620070018881_09935417206929246064486_21739530852328700789183845_619471746722927151121122_pdf

    • Size

      179KB

    • MD5

      f18ecb4ec01c8696b450b53e255f8e32

    • SHA1

      18e24ceb9004c164db0d204d9ca513b5a64060fa

    • SHA256

      b805f68139469a793d97d7082a7d46a5eedcea8fa39676fd4ce557dae2725fff

    • SHA512

      59f5c4616b17aaeba753318fcffacba71dc76bcc599665e31a50e7d31026ed2edc598bd285b1de9e19a09e9a6987318be3f17cee827a7b7ce2a89e6385d8f36d

    Score
    10/10
    remcosevasionpersistencerattrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

4
T1089

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks