General
-
Target
SecuriteInfo.com.Win32.CrypterX-gen.14393.22730.exe
-
Size
1.2MB
-
Sample
221007-jcdj6abhb3
-
MD5
15be8b16b4132041249cdb082b7fee5d
-
SHA1
51d556a7c92898bc8884d171a45b9e976c3afd7d
-
SHA256
b893cb34f5bdccee94379aed6977ed09b939716cb1e982fb9a88a6ca1e4c1029
-
SHA512
6b6a86d4a960e830c3eda6365a6a22e7f6dc5e6290e0ba9b54cb0737b2ea10be44ea4af4c251e0604aa1132509eb76f8bf940d2e3aaed551907c3d559ebcaf83
-
SSDEEP
24576:7ajrXK8RcWpZxCWD1fcv6LMdPJctqy2Gcoc:+PBDCvGM3ct2bb
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.CrypterX-gen.14393.22730.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.CrypterX-gen.14393.22730.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
remcos
XP
xpremcuz300622.ddns.net:3542
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
oos.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Remcos-MMP2I7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
kkl
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
SecuriteInfo.com.Win32.CrypterX-gen.14393.22730.exe
-
Size
1.2MB
-
MD5
15be8b16b4132041249cdb082b7fee5d
-
SHA1
51d556a7c92898bc8884d171a45b9e976c3afd7d
-
SHA256
b893cb34f5bdccee94379aed6977ed09b939716cb1e982fb9a88a6ca1e4c1029
-
SHA512
6b6a86d4a960e830c3eda6365a6a22e7f6dc5e6290e0ba9b54cb0737b2ea10be44ea4af4c251e0604aa1132509eb76f8bf940d2e3aaed551907c3d559ebcaf83
-
SSDEEP
24576:7ajrXK8RcWpZxCWD1fcv6LMdPJctqy2Gcoc:+PBDCvGM3ct2bb
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-