Overview

overview

10

Static

static

Factura Se...28.exe

windows7_x64

10

Factura Se...28.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Factura Serfinanza089768553548090985869814228.exe

  • Size

    183KB

  • Sample

    210426-xkj2yksnp6

  • MD5

    c1b9c27c13f700813890b186b09bf55a

  • SHA1

    a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

  • SHA256

    e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

  • SHA512

    5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:3521

Targets

    • Target

      Factura Serfinanza089768553548090985869814228.exe

    • Size

      183KB

    • MD5

      c1b9c27c13f700813890b186b09bf55a

    • SHA1

      a816f0a3df54453fd3dec7e91cc17d0eeb74ee81

    • SHA256

      e4087f56d9f1aae9eb98d19654465241c4b1c52bac4d7e4c5cbea11cb3244905

    • SHA512

      5f03a562eccc1dce9a881c8637a3e4c56e9daeb1869392fa7b4134ec8000800962cc44cd0ef91dd03ff46053db08d767460c9008bb4dfdecc230bb4cd22737d2

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks