General
-
Target
5e03391416c87bb92ec2dbfb9ec1cb1eddc475cd06b9e2cb139c636ac473aabc
-
Size
432KB
-
Sample
220731-1k1s4aaegr
-
MD5
67ef9183c7b458e3a8c71f55baaf976b
-
SHA1
1d937564dee6827ae2ea96683b8367d1a1f62b3c
-
SHA256
5e03391416c87bb92ec2dbfb9ec1cb1eddc475cd06b9e2cb139c636ac473aabc
-
SHA512
ef1c354b1e0ea195b03bea731c155970f5a332c66c98d801b67237fd86b7824c727ebfac3967b883aef5662b285b58cf4febfc7198f887f568b5a37d508e0a09
Static task
static1
Behavioral task
behavioral1
Sample
5e03391416c87bb92ec2dbfb9ec1cb1eddc475cd06b9e2cb139c636ac473aabc.exe
Resource
win7-20220718-en
Malware Config
Extracted
remcos
2.0.4 Pro
RemoteHost
Wealths.ddns.net:5050
wealthy.duckdns.org:5050
wealths.duckdns.org:5050
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
3
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%Temp%
-
mouse_option
false
-
mutex
Remcos-LQUE6V
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
netwire
wealthyman.ddns.net:39560
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
sunshineslisa
-
keylogger_dir
C:\Users\Admin\AppData\Roaming\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
5e03391416c87bb92ec2dbfb9ec1cb1eddc475cd06b9e2cb139c636ac473aabc
-
Size
432KB
-
MD5
67ef9183c7b458e3a8c71f55baaf976b
-
SHA1
1d937564dee6827ae2ea96683b8367d1a1f62b3c
-
SHA256
5e03391416c87bb92ec2dbfb9ec1cb1eddc475cd06b9e2cb139c636ac473aabc
-
SHA512
ef1c354b1e0ea195b03bea731c155970f5a332c66c98d801b67237fd86b7824c727ebfac3967b883aef5662b285b58cf4febfc7198f887f568b5a37d508e0a09
-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-