General
-
Target
1d22a7a17d50bd434e2e042ad9f64ea40631c41c7f35216c0662666748a66b45
-
Size
676KB
-
Sample
221014-c8b8msdbhm
-
MD5
04ad54f735adb698d516f64fdca3d8d1
-
SHA1
0c1bb7c47b7bfd72cbdd67cb129dbfabde88cfc8
-
SHA256
1d22a7a17d50bd434e2e042ad9f64ea40631c41c7f35216c0662666748a66b45
-
SHA512
63de2f64f760073f1de287114db9463e993fe7db7f3efd3c88ee33332ca0cac9ce21ef280d979e6c940c80edf9a6658c2f69e971f11e78909d48984bd447b766
-
SSDEEP
12288:S5gEwpGsYpvFRWJSDsw5jhC3CXjYstVSX3x7FRS8Hj/9lpB8:Sy3jYpvFRWJyrFSCX5tVSn52ArpB8
Static task
static1
Behavioral task
behavioral1
Sample
1d22a7a17d50bd434e2e042ad9f64ea40631c41c7f35216c0662666748a66b45.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1d22a7a17d50bd434e2e042ad9f64ea40631c41c7f35216c0662666748a66b45.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
remcos
DUCKDOMAIN-FILE
dapsan.duckdns.org:2404
www.dapsan.biz:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BERTBE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
1d22a7a17d50bd434e2e042ad9f64ea40631c41c7f35216c0662666748a66b45
-
Size
676KB
-
MD5
04ad54f735adb698d516f64fdca3d8d1
-
SHA1
0c1bb7c47b7bfd72cbdd67cb129dbfabde88cfc8
-
SHA256
1d22a7a17d50bd434e2e042ad9f64ea40631c41c7f35216c0662666748a66b45
-
SHA512
63de2f64f760073f1de287114db9463e993fe7db7f3efd3c88ee33332ca0cac9ce21ef280d979e6c940c80edf9a6658c2f69e971f11e78909d48984bd447b766
-
SSDEEP
12288:S5gEwpGsYpvFRWJSDsw5jhC3CXjYstVSX3x7FRS8Hj/9lpB8:Sy3jYpvFRWJyrFSCX5tVSn52ArpB8
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Blocklisted process makes network request
-
Adds Run key to start application
-