General
-
Target
046804d6a8900b2fff9596823db0ce93.exe
-
Size
2.9MB
-
Sample
220525-j6958ahda7
-
MD5
046804d6a8900b2fff9596823db0ce93
-
SHA1
0857ec6ee9d27042117d30a86f968ef6864d6e42
-
SHA256
abde95665f00d689ae82d87023f15c909e8648e5d320b7fe680cdf910ec489ad
-
SHA512
0a9c989453e9d9829a79922ddff9c464f4653f8db84a140e8e94f813568ed933e0290aad0ea0523a8e0579b2ff2428af231c73a879e1dd0cfb8aae6dbd329202
Static task
static1
Behavioral task
behavioral1
Sample
046804d6a8900b2fff9596823db0ce93.exe
Resource
win7-20220414-en
Malware Config
Extracted
remcos
RH1
185.29.9.125:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
itunes.exe
-
copy_folder
RMS
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Jd1985-XODZWD
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Rms
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
046804d6a8900b2fff9596823db0ce93.exe
-
Size
2.9MB
-
MD5
046804d6a8900b2fff9596823db0ce93
-
SHA1
0857ec6ee9d27042117d30a86f968ef6864d6e42
-
SHA256
abde95665f00d689ae82d87023f15c909e8648e5d320b7fe680cdf910ec489ad
-
SHA512
0a9c989453e9d9829a79922ddff9c464f4653f8db84a140e8e94f813568ed933e0290aad0ea0523a8e0579b2ff2428af231c73a879e1dd0cfb8aae6dbd329202
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-