Overview

overview

10

Static

static

doc_07621D...00.exe

windows7_x64

10

doc_07621D...00.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    doc_07621DERG7011220213300.exe

  • Size

    1.1MB

  • Sample

    210502-6jrbgd9g7a

  • MD5

    3295f12e797cd867575617f57c091b42

  • SHA1

    e399c5bc013640afc56f21e19f45e971696f92f2

  • SHA256

    210d63272f04545a7b964c5712b0157a9e9801500e063a15ecee4b2de2c87254

  • SHA512

    a6e85e0f6095e00fd37af065c47892e025b59a0c63c62b3d33802565d5b2ca8c50caf0268a7fdd36b69847ecef2ae4e6a0e0310528b0de0fbad9cc6609831c8b

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

www.swqrn.com:16108

Targets

    • Target

      doc_07621DERG7011220213300.exe

    • Size

      1.1MB

    • MD5

      3295f12e797cd867575617f57c091b42

    • SHA1

      e399c5bc013640afc56f21e19f45e971696f92f2

    • SHA256

      210d63272f04545a7b964c5712b0157a9e9801500e063a15ecee4b2de2c87254

    • SHA512

      a6e85e0f6095e00fd37af065c47892e025b59a0c63c62b3d33802565d5b2ca8c50caf0268a7fdd36b69847ecef2ae4e6a0e0310528b0de0fbad9cc6609831c8b

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks