General
-
Target
1.exewjpfrrtc
-
Size
2.9MB
-
Sample
220626-fx4qasgecr
-
MD5
110bc33bdd915c5738f427019eaacf53
-
SHA1
089e1d1676bc0d99bbd8233c4673a2abd3e389b8
-
SHA256
da250da3b237fd0acf29d52066c84d56da4f92e5e854c71b5d6a4d7b121dae9c
-
SHA512
5960838f53dfc3e9b31d829c6fd1a4d36b3e36d63339fdc73ae70d1fe2c6ee55776e8e7053b5ad06330ed09cbbd07caf606b643469b1d0890dfb81c7477b70a3
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220414-en
Malware Config
Extracted
remcos
RH1
185.29.9.125:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
itunes.exe
-
copy_folder
RMS
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Jd1985-XODZWD
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Rms
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
1.exewjpfrrtc
-
Size
2.9MB
-
MD5
110bc33bdd915c5738f427019eaacf53
-
SHA1
089e1d1676bc0d99bbd8233c4673a2abd3e389b8
-
SHA256
da250da3b237fd0acf29d52066c84d56da4f92e5e854c71b5d6a4d7b121dae9c
-
SHA512
5960838f53dfc3e9b31d829c6fd1a4d36b3e36d63339fdc73ae70d1fe2c6ee55776e8e7053b5ad06330ed09cbbd07caf606b643469b1d0890dfb81c7477b70a3
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-