Overview

overview

10

Static

static

e999fdd6a0...70.exe

windows7_x64

10

e999fdd6a0...70.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e999fdd6a0f5f8d1ca08cf2aef47f5ddc0ee75879c6f2c1ee23bc31fb0f26c70

  • Size

    186KB

  • Sample

    220128-wac7tshgf8

  • MD5

    8ff436b4a5743ef1903b372c52567319

  • SHA1

    bfe56f8254bc5bb4a976a6bea15c52316ad5b2bc

  • SHA256

    e999fdd6a0f5f8d1ca08cf2aef47f5ddc0ee75879c6f2c1ee23bc31fb0f26c70

  • SHA512

    096873352bba3ad912f614dd53694f904f1ba2ad02f205c976a3e86503bcf9c5e3fe8d9fed6ac0d55f155db171f05bc6965588b62388f21284fe560019b6817d

Score
10/10
remcoshostpersistenceratupx

Malware Config

Extracted

Family

remcos

Version

1.7.4 Pro

Botnet

Host

C2

remserver.ddns.net:80

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    32

  • connect_interval

    45

  • copy_file

    MsUpdate.exe

  • copy_folder

    MsUpdate

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    MSLogs

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    ftgBhyI^--jj%9*520.[]?/-5Z7XTO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    MsScreens

  • screenshot_path

    %AppData%

  • screenshot_time

    5

  • startup_value

    MsUpdate

  • take_screenshot_option

    false

  • take_screenshot_time

    10

  • take_screenshot_title

    login;outlook;signin;military;skype;gmail;mail;inbox;

Targets

    • Target

      e999fdd6a0f5f8d1ca08cf2aef47f5ddc0ee75879c6f2c1ee23bc31fb0f26c70

    • Size

      186KB

    • MD5

      8ff436b4a5743ef1903b372c52567319

    • SHA1

      bfe56f8254bc5bb4a976a6bea15c52316ad5b2bc

    • SHA256

      e999fdd6a0f5f8d1ca08cf2aef47f5ddc0ee75879c6f2c1ee23bc31fb0f26c70

    • SHA512

      096873352bba3ad912f614dd53694f904f1ba2ad02f205c976a3e86503bcf9c5e3fe8d9fed6ac0d55f155db171f05bc6965588b62388f21284fe560019b6817d

    Score
    10/10
    remcoshostpersistenceratupx

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks