Overview

overview

10

Static

static

IMG002.exe

windows7-x64

10

IMG002.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3B3023D6229D36E0AEA11B5D720BF9E660A0C50950CAFA4C2BA296AC7F062A71

  • Size

    58KB

  • Sample

    221123-r1kblsch8z

  • MD5

    ff79d9030edf88879af81133217f4b65

  • SHA1

    a571f35e4ceaa4e5a89c7fbb3320e20977c69b78

  • SHA256

    3b3023d6229d36e0aea11b5d720bf9e660a0c50950cafa4c2ba296ac7f062a71

  • SHA512

    18a9e1d10da71f3c2506611a5a7a62a0ef1c0b2a929139117a6089dd220a0eb56407b84209f3aea06a4ea47147a1a512e0d8930ae70b6039f0203e4eecd47016

  • SSDEEP

    96:5GkG7kGza7pI50pKG1iNNeLdbbDBn225rFy6Ydk2fKtk6RFnUV:MkG7kGx2pN1pLdTBn225r0EED

Score
10/10
remcosremotepersistencerat

Malware Config

Extracted

Family

remcos

Botnet

Remote

C2

79.110.62.46:50499

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    windowss

  • mouse_option

    false

  • mutex

    fg4wer4s5trgfqewdc-WR9LLO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      IMG002.exe

    • Size

      6KB

    • MD5

      f5aaeef78a7f8aa64923c3186a4e639f

    • SHA1

      cb29af3a814e40a809528f10076152ea2f450651

    • SHA256

      08a87793c7ca10af688ef68cf54f4e5a632bef11145a60c6e48027ca91c386a5

    • SHA512

      c736dfa6f0b0047409de0ae6df0b663b139ffee7a9de1f82d5967bdd1a4d6e84fcb2ec1a528104cf466264ebf91f85ebb70fd9a6368308e49b1b2bbc661de752

    • SSDEEP

      96:sa7pI50pKG1iNNeLdbbDBn225rFy6Ydk2fKtk6RFnU:s2pN1pLdTBn225r0EED

    Score
    10/10
    remcosremotepersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks