Overview

overview

10

Static

static

Jc7rIzvMGq...9E.exe

windows7_x64

10

Jc7rIzvMGq...9E.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Jc7rIzvMGq2Y04X5z29E.exe
  • Size 1.1MB
  • Sample210505-ak2a5qdy7j
  • SHA256 8ddbf9769d71a2b946894307864aa35aee8afb86a469a6c032b7eaa1225bc720
  • MD5 SHA1 SHA512
Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

  • remcos

C2

  • style.ptbagasps.co.id:42024

Targets

    • Target
      Jc7rIzvMGq2Y04X5z29E.exe
    • Size 1.1MB
    • SHA256 8ddbf9769d71a2b946894307864aa35aee8afb86a469a6c032b7eaa1225bc720
    • MD5 SHA1 SHA512
    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks