General

  • Target

    a1990886962a1099568261dba39d5093.exe

  • Size

    1.1MB

  • Sample

    210506-k5188nte9n

  • MD5

    a1990886962a1099568261dba39d5093

  • SHA1

    5bd0bd3a6371f536d75fc384a7f8433311bedb78

  • SHA256

    b2c6522e33aaab89652cba0f9266435563eed285db3dff387e1ee12a6d28e898

  • SHA512

    f90ed573ef68a616f67e7fdb6bf6e3f2256fddf9c0acc22eb9ecff6d3bd4f414acb910ef4f2fbc493d8ff5afeadf88795ae571eb9815e3807f3601a440196c2b

Score
10/10

Malware Config

Extracted

Family

remcos

C2

hjduiebcvzcalpmjdbcnwqadhsiybcnzxswedgap.ydns.eu:2024

Targets

    • Target

      a1990886962a1099568261dba39d5093.exe

    • Size

      1.1MB

    • MD5

      a1990886962a1099568261dba39d5093

    • SHA1

      5bd0bd3a6371f536d75fc384a7f8433311bedb78

    • SHA256

      b2c6522e33aaab89652cba0f9266435563eed285db3dff387e1ee12a6d28e898

    • SHA512

      f90ed573ef68a616f67e7fdb6bf6e3f2256fddf9c0acc22eb9ecff6d3bd4f414acb910ef4f2fbc493d8ff5afeadf88795ae571eb9815e3807f3601a440196c2b

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Tasks