General

  • Target

    tmp

  • Size

    914KB

  • Sample

    220806-j14q9acdgq

  • MD5

    2c423d03a39192e874aab20c14d1883b

  • SHA1

    023cf31791a48de9cc1ac9e2b98e47393f1d0e3b

  • SHA256

    6e4597db411c7c93428ddc24f95c2d4a16c91263c12344923c04aceae016834d

  • SHA512

    479d80a09d6792340f1999b51d02e59a5a578734ae6af1102dc54a0fa79040f43d6878fbd8acfd1fd57cb3751077b65c4ac1bd64a04e8f39c9dc213166cc1b5c

Malware Config

Extracted

Family

remcos

Botnet

ceo_nasco

C2

194.5.98.28:7006

Attributes
audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_zxeqqeixcisywfn
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

    • Target

      tmp

    • Size

      914KB

    • MD5

      2c423d03a39192e874aab20c14d1883b

    • SHA1

      023cf31791a48de9cc1ac9e2b98e47393f1d0e3b

    • SHA256

      6e4597db411c7c93428ddc24f95c2d4a16c91263c12344923c04aceae016834d

    • SHA512

      479d80a09d6792340f1999b51d02e59a5a578734ae6af1102dc54a0fa79040f43d6878fbd8acfd1fd57cb3751077b65c4ac1bd64a04e8f39c9dc213166cc1b5c

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation