Overview

overview

10

Static

static

4fb5476bfc...49.exe

windows7-x64

10

4fb5476bfc...49.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049

  • Size

    919KB

  • Sample

    221028-1tfjhsgha9

  • MD5

    d2274c53bdf4dbff1e39be9adcd8d90d

  • SHA1

    3b6efda0ab45013c3bfa28432adb180b324f3c89

  • SHA256

    a3d2a0011ed5bddfd9ab11fed76afbd5d56d5a4ead896110944eea0f1a30c7de

  • SHA512

    b382069b4a71eeafc53f6e9be9bf7a4e39ea8daaba46f949f54be3ce75e52f9eb3f454a741bc3db602bfb98bb5160073fbbf319b800e9182d87c62f0ad122537

  • SSDEEP

    12288:S0FEXP6YMudnezYqf2mtAcTvN8jghulV1h9Sq8TA15isBaoQ5WrO66kfE+uEiriW:SMEfKwXacgi73coLJ9BirifUB

Score
10/10
remcosxppersistencerat

Malware Config

Extracted

Family

remcos

Botnet

XP

C2

xpremcuz300622.ddns.net:3542

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    oos.exe

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Remcos-MMP2I7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    kkl

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049

    • Size

      936KB

    • MD5

      c44491911d5cfcc1dc31ac019c2714aa

    • SHA1

      635e1be851baee85fb17cb2781bc6d9ee6a94f8b

    • SHA256

      4fb5476bfc11cb3da1feffa767cc7abb70040bd0b11c0e26a7e4d2bdc2d5e049

    • SHA512

      e4649b1878060833939f6762df5a95275f4b5c4b7108eab2100140a2a5fbd39374d8f9e177a9182423c74d246808e68228f6dd6b6cf109894a255f8ce4505c15

    • SSDEEP

      12288:/44mF6XP6Cau9Jez6Qf2ItKcTvNwjc5ul/1hfeq85A1DisBCos5yrO6okfY+uEjQ:/Ba6fsWlawcWrZYoZfBBj

    Score
    10/10
    remcosxpratpersistence

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks