Overview

overview

10

Static

static

9ed17a3e51...a8.exe

windows7_x64

10

9ed17a3e51...a8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ed17a3e5105ce4397d81965069ac0a8.exe

  • Size

    1.7MB

  • Sample

    210511-abebwyek62

  • MD5

    9ed17a3e5105ce4397d81965069ac0a8

  • SHA1

    bfba64c4d42ccd0c22409a9c2b72f72d68949d61

  • SHA256

    4f8e0185fbd30f92a58d1846b85105db4942fb932c10c57705e6ff1a856d804d

  • SHA512

    b85bc043b89c68c51d6c365d58f3592065a9bca6823864b6567800084b74c7a8c8d2cc0c916f6213ce6e5d7cb98ca40e6e77802d14c330711af60848c83ac9da

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

ghdyuienah123.freedynamicdns.org:2006

Targets

    • Target

      9ed17a3e5105ce4397d81965069ac0a8.exe

    • Size

      1.7MB

    • MD5

      9ed17a3e5105ce4397d81965069ac0a8

    • SHA1

      bfba64c4d42ccd0c22409a9c2b72f72d68949d61

    • SHA256

      4f8e0185fbd30f92a58d1846b85105db4942fb932c10c57705e6ff1a856d804d

    • SHA512

      b85bc043b89c68c51d6c365d58f3592065a9bca6823864b6567800084b74c7a8c8d2cc0c916f6213ce6e5d7cb98ca40e6e77802d14c330711af60848c83ac9da

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks