Overview

overview

10

Static

static

Quote&Invoice.exe

windows7_x64

10

Quote&Invoice.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    293f90fc550689f46c39bb87ca866648086ff32786890a8a63de1ef4f983a07e

  • Size

    145KB

  • Sample

    220521-n7mtjaegd2

  • MD5

    84f52e6c293da20e0a5ef6b41e79f0aa

  • SHA1

    5faf46cc4efce63375fa10a7255ac0bb36136985

  • SHA256

    293f90fc550689f46c39bb87ca866648086ff32786890a8a63de1ef4f983a07e

  • SHA512

    8373163772a4c773367440bf660d940cb79b9df56a5a7f9555311c76749d17197dedec64503232321ae7f6b664dd42c7bdeaa72d8d78d6569926b04d86d32c4e

Score
10/10
remcosclient_pulserat

Malware Config

Extracted

Family

remcos

Version

2.6.0 Pro

Botnet

Client_Pulse

C2

185.172.111.213:27015

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    1

  • connect_interval

    3

  • copy_file

    cos.exe

  • copy_folder

    cos

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    cos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    cos-JDD72J

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Targets

    • Target

      Quote&Invoice.pif

    • Size

      313KB

    • MD5

      1fbf74602dd86ce47486ccfd07d8d949

    • SHA1

      7c0199921dc0cb8eca7d9bc1a417853ede3ea1c1

    • SHA256

      4ea16682c6d48eb737c1857beceadc3d3077921c03fa62d9dad44d551d92729d

    • SHA512

      472c22d57bc9c0953b49dfebdf35c47a877549d71dd00a7076fc0785d6269648dee083224b666f06ad2e528308ff8ceebca42b2c0180a461607b2866e2559d33

    Score
    10/10
    remcosclient_pulserat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks