Overview

overview

10

Static

static

Factura Se...55.exe

windows7_x64

10

Factura Se...55.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Factura Serfinanza075728689544681589138450755.exe

  • Size

    178KB

  • Sample

    210423-zccw2nkhlj

  • MD5

    c18be2c2ed330866ac36fa08363cf58b

  • SHA1

    625c4a4390f3ec92e44f343d86110e71d71b3d5f

  • SHA256

    584edf26fed1b12e7abb512248a729e7aa7cb8c7fe19c3770cf3f763adaf730e

  • SHA512

    9d50f47276fde6617ff668796c7fd62fdba06983a6106761cef46dc395ab0c8f86c065ca3be3f8231ea2a2626e929c8d3b0b2711f31389f607d97bfb919bbe2e

Score
10/10
remcosevasionpersistencerattrojan

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:3521

Targets

    • Target

      Factura Serfinanza075728689544681589138450755.exe

    • Size

      178KB

    • MD5

      c18be2c2ed330866ac36fa08363cf58b

    • SHA1

      625c4a4390f3ec92e44f343d86110e71d71b3d5f

    • SHA256

      584edf26fed1b12e7abb512248a729e7aa7cb8c7fe19c3770cf3f763adaf730e

    • SHA512

      9d50f47276fde6617ff668796c7fd62fdba06983a6106761cef46dc395ab0c8f86c065ca3be3f8231ea2a2626e929c8d3b0b2711f31389f607d97bfb919bbe2e

    Score
    10/10
    remcosevasionpersistencerattrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

4
T1089

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks