Overview

overview

10

Static

static

TPE-CHESTE...08.scr

windows7_x64

10

TPE-CHESTE...08.scr

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr

  • Size

    260KB

  • Sample

    210426-j7xb6g8d72

  • MD5

    84bc6ece04588d297e5f957f8c0eed1a

  • SHA1

    47b0cfaaef2a8dceeb377e822094fd8a97b6fc0b

  • SHA256

    d9c227ed57ca134b518a38f74580faf7f3c5e05c5caae3ed3166641341950ee7

  • SHA512

    83c546bebebe502a4239c18e29230dec4a3df29568ff97cec6b64fa00801b2572ee738b0f74d9a11f693fff34f6b23db8edbfc16a4b5baa1482ff604314600f1

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

188.72.124.143:2858

Targets

    • Target

      TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr

    • Size

      260KB

    • MD5

      84bc6ece04588d297e5f957f8c0eed1a

    • SHA1

      47b0cfaaef2a8dceeb377e822094fd8a97b6fc0b

    • SHA256

      d9c227ed57ca134b518a38f74580faf7f3c5e05c5caae3ed3166641341950ee7

    • SHA512

      83c546bebebe502a4239c18e29230dec4a3df29568ff97cec6b64fa00801b2572ee738b0f74d9a11f693fff34f6b23db8edbfc16a4b5baa1482ff604314600f1

    Score
    10/10
    remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks