Overview

overview

10

Static

static

PEDIDO DE ...df.exe

windows7_x64

10

PEDIDO DE ...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PEDIDO DE COMPRA ASHCROFT - 41901E-001,pdf.exe

  • Size

    855KB

  • Sample

    210727-dlt29nkmrx

  • MD5

    736f3c1b37dc7f871643e576a85580d6

  • SHA1

    7d56fb1757965377236d265de04b3fec810cfe98

  • SHA256

    75b6c107ad6001f2588229fbfdb96dc998fe9f3e44f8df69c98096aceea9aa73

  • SHA512

    f28fba7afd7879fe27d0b344e1b0a17201514960dfe16756c64f36b3f778bcd86b3e9918a232f2436bf3abd719ecb37876672626402338f103d7ab3a7205c078

Score
10/10
modiloaderremcosgoodpersistencerattrojan

Malware Config

Extracted

Family

remcos

Botnet

GOOD

C2

goddywin.freedynamicdns.net:7310

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-VNAWKK

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      PEDIDO DE COMPRA ASHCROFT - 41901E-001,pdf.exe

    • Size

      855KB

    • MD5

      736f3c1b37dc7f871643e576a85580d6

    • SHA1

      7d56fb1757965377236d265de04b3fec810cfe98

    • SHA256

      75b6c107ad6001f2588229fbfdb96dc998fe9f3e44f8df69c98096aceea9aa73

    • SHA512

      f28fba7afd7879fe27d0b344e1b0a17201514960dfe16756c64f36b3f778bcd86b3e9918a232f2436bf3abd719ecb37876672626402338f103d7ab3a7205c078

    Score
    10/10
    remcosgoodpersistenceratmodiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks