Overview

overview

10

Static

static

shipment.exe

windows7-x64

10

shipment.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    shipment.exe

  • Size

    6KB

  • Sample

    221005-qjc1jaedd3

  • MD5

    f29c78538354b88cf5c132b5135f1821

  • SHA1

    08554577f70e31926184981c11b5f41a3e35fc69

  • SHA256

    03b60f45075adb83851032b695e37f3a6b3ac15fbdc7cf05eeca9da7f6d6fcfe

  • SHA512

    d19fb91647c3e4882a536f35433dfa7c1f4f6fdccf2706f2af8b36782e8f2cd65297737e1fd2d292c2a2da27c58f9505262b4c0780ef955b015cbec1f400a3a8

  • SSDEEP

    96:XQJ06l0bPmTWl5ma6h1vwLM1ow+fYv9mS8xYDxeYZzNt:qVWPmJwLMl4cmSD1b

Score
10/10
remcosrexpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

rex

C2

45.155.165.160:40567

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-2UAJG6

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      shipment.exe

    • Size

      6KB

    • MD5

      f29c78538354b88cf5c132b5135f1821

    • SHA1

      08554577f70e31926184981c11b5f41a3e35fc69

    • SHA256

      03b60f45075adb83851032b695e37f3a6b3ac15fbdc7cf05eeca9da7f6d6fcfe

    • SHA512

      d19fb91647c3e4882a536f35433dfa7c1f4f6fdccf2706f2af8b36782e8f2cd65297737e1fd2d292c2a2da27c58f9505262b4c0780ef955b015cbec1f400a3a8

    • SSDEEP

      96:XQJ06l0bPmTWl5ma6h1vwLM1ow+fYv9mS8xYDxeYZzNt:qVWPmJwLMl4cmSD1b

    Score
    10/10
    remcosrexpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks