Overview

overview

10

Static

static

Maxima Tra...st.exe

windows7_x64

10

Maxima Tra...st.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    acb0e3ade37ec8109f0632867facd376ccb625cb5c57a155a2f201978dcf42fd

  • Size

    207KB

  • Sample

    220521-n2td5ahfcq

  • MD5

    5f6fdb83c7e14d4e8549ec5a5450ed27

  • SHA1

    68b719c2a13eff853f7ca5be87373f526b45ab4f

  • SHA256

    acb0e3ade37ec8109f0632867facd376ccb625cb5c57a155a2f201978dcf42fd

  • SHA512

    f9e043db5c1e137c4f3f820c4010deb58ff98dde9baf3cc87ac38aed584915b52c20630003bd70f3685d791a192bb4679266d2101983b697478dc35cecdfc735

Score
10/10
remcoshostrat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

185.202.175.219:4110

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_swjvxphbqp

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

Targets

    • Target

      Maxima Tradings - Products List.exe

    • Size

      348KB

    • MD5

      84dc282e39752e719b5637df7caaf6b0

    • SHA1

      0ba3ad0610cbf07b29c26e6aa5727d3aca4a1224

    • SHA256

      de230ff3cc63114dae0ded7be0a613b0f0fe08da90eb75bfebac7a0368c58187

    • SHA512

      b75477277a8e2462bb0aed464eb5f5f5166b8445ee9fd569937def0082108dfaf23b45ca9de55b55c46f0e1b76bc8d0b4727da6aa6d537bd7b8148bc2d936f47

    Score
    10/10
    remcoshostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks