General

  • Target

    4cd864cf3d39baff963a023423237dd164ce0e5de001d1397031b74c3b26691e

  • Size

    986KB

  • Sample

    220805-ld69zaaeen

  • MD5

    e3e2371b9c9faa09afe127d0f0e12f3b

  • SHA1

    dfddf15a3f3f77cb5c4798eff4e3c529ad049db8

  • SHA256

    4cd864cf3d39baff963a023423237dd164ce0e5de001d1397031b74c3b26691e

  • SHA512

    1ea05e84d5cdeff9e5e9f4d1b829d8e11c30ae38a2a36c6c661239e93b6ce5e4610fce148cf0aadf6926136087e00d9dcbfcd1677717eb6905d8bebf3e6079d3

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

www.varshtrade.com:2404

Attributes
audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
notepad
mouse_option
false
mutex
notepad-TFQMB3
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

    • Target

      4cd864cf3d39baff963a023423237dd164ce0e5de001d1397031b74c3b26691e

    • Size

      986KB

    • MD5

      e3e2371b9c9faa09afe127d0f0e12f3b

    • SHA1

      dfddf15a3f3f77cb5c4798eff4e3c529ad049db8

    • SHA256

      4cd864cf3d39baff963a023423237dd164ce0e5de001d1397031b74c3b26691e

    • SHA512

      1ea05e84d5cdeff9e5e9f4d1b829d8e11c30ae38a2a36c6c661239e93b6ce5e4610fce148cf0aadf6926136087e00d9dcbfcd1677717eb6905d8bebf3e6079d3

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation