General

  • Target

    NEW INQUIRY DATA.exe

  • Size

    999KB

  • Sample

    220915-t5nwpsdfc9

  • MD5

    785014113a10b77c79af5d6cc0eb4c0e

  • SHA1

    18fc67728a7151c38d1b3c754a73444c1c9089f5

  • SHA256

    788a6a0d67e10a4235043d0f12cc5841ab77bac0518842aea964e720318f674d

  • SHA512

    d4344156a1d55613cbcf09571b08938a188d065cbedec2a8e8a4355611f467ff9396d4704cdf0d2a728054d2f280817d13377449e80b754ee9df1e1a1e245b56

  • SSDEEP

    12288:chZ2L+SDNjt8C9sdGfgth88mUbeMhqcfC8QPztJ/Pd6bG5zUWlP4NBu0rpEZpa1D:IsrB9CwgtAUSMTkJ/8bGANrD6Q5Ew

Malware Config

Extracted

Family

remcos

Botnet

NEW REM STUB

C2

valvesco.duckdns.org:5050

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-48V73L

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      NEW INQUIRY DATA.exe

    • Size

      999KB

    • MD5

      785014113a10b77c79af5d6cc0eb4c0e

    • SHA1

      18fc67728a7151c38d1b3c754a73444c1c9089f5

    • SHA256

      788a6a0d67e10a4235043d0f12cc5841ab77bac0518842aea964e720318f674d

    • SHA512

      d4344156a1d55613cbcf09571b08938a188d065cbedec2a8e8a4355611f467ff9396d4704cdf0d2a728054d2f280817d13377449e80b754ee9df1e1a1e245b56

    • SSDEEP

      12288:chZ2L+SDNjt8C9sdGfgth88mUbeMhqcfC8QPztJ/Pd6bG5zUWlP4NBu0rpEZpa1D:IsrB9CwgtAUSMTkJ/8bGANrD6Q5Ew

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks