Overview

overview

10

Static

static

10

Helium-dAp....2.exe

windows10-2004-x64

10

Helium-dAp....2.exe

windows11-21h2-x64

Resubmissions

01-08-2022 22:58

220801-2x541sbagp 10

01-08-2022 19:40

220801-ydnh3shffl 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Helium-dApp-v2.1.2.exe.zip

  • Size

    41.4MB

  • Sample

    220801-2x541sbagp

  • MD5

    305dde0a3898fda7625d6c52ba0665c7

  • SHA1

    e702810cfc6900c49cffb7768ccf3322d7ca705f

  • SHA256

    23bea1864fdf68b0b774208f921308d2ae0e5f3b76851c4b5dbb9e28e3a16bae

  • SHA512

    8795c85cd4854199541f6304ef7d7a6101afd48ec49609df3c8b3542fedffbdf585de9bf913d5ad1e790c56996a084fa497110fc5fa3768fb2f311fa04f925e0

Score
10/10
babadedaredlineremcossys32crypterloaderpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

Sys32

C2

65.108.9.124:4783

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    Logs

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Sys32-PI9IVT

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Helium-dApp-v2.1.2.exe

    • Size

      129.3MB

    • MD5

      5f98efd920eff5241d487d12aaf24c23

    • SHA1

      0be0ff093a58784af0f3e06e2183ce6fdd7f4ef9

    • SHA256

      61b7877f85a4dc56e3cd9d34e80219f8d6fc0ea2f09aa3ae3cb9ea1d099030d1

    • SHA512

      a7130040baf06c8b2dccba72308ef846e95b864802f7eb92e0b54240afa8937c34c2bdaabad522bbaab20cd6d141189dc0ad18cbb5328218b30a51d52a55e731

    Score
    10/10
    babadedaremcossys32crypterloaderpersistencerat

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

      loadercrypterbabadeda

    • Babadeda Crypter

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks