Overview

overview

10

Static

static

e87faa9e17...30.exe

windows7_x64

10

e87faa9e17...30.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e87faa9e1757110d9cff0d87ffb929803720faa01c6f16be73889de436e7fd30

  • Size

    1.1MB

  • Sample

    210509-hf3m7ax55a

  • MD5

    fb03f8d3a9fa0a1f442bee0b65c0b39f

  • SHA1

    c6b66f637ec30a8aacf94047835b463a677ec80a

  • SHA256

    e87faa9e1757110d9cff0d87ffb929803720faa01c6f16be73889de436e7fd30

  • SHA512

    654c8962cd020f6e97cf6f326f9f3213ba0d1fb6a36365bbd973043d00245977ec8d880fc815e921b7a83b6df9e50ee33fc557727fbb54f86d5fb4e89bb177b0

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

daya4659.ddns.net:8282

Targets

    • Target

      e87faa9e1757110d9cff0d87ffb929803720faa01c6f16be73889de436e7fd30

    • Size

      1.1MB

    • MD5

      fb03f8d3a9fa0a1f442bee0b65c0b39f

    • SHA1

      c6b66f637ec30a8aacf94047835b463a677ec80a

    • SHA256

      e87faa9e1757110d9cff0d87ffb929803720faa01c6f16be73889de436e7fd30

    • SHA512

      654c8962cd020f6e97cf6f326f9f3213ba0d1fb6a36365bbd973043d00245977ec8d880fc815e921b7a83b6df9e50ee33fc557727fbb54f86d5fb4e89bb177b0

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks