General
-
Target
0ee05e5c62ae8786f7d318ea48edf16fcc47d6031e13a9dae563ec8efbcb3e56
-
Size
1.0MB
-
Sample
221129-15fcwsfg3z
-
MD5
0be2f1c22f5916d0cdb44ebccc39e18c
-
SHA1
731b7d2929de2b7d9a1a03f4372f4c5553c8e5ec
-
SHA256
0ee05e5c62ae8786f7d318ea48edf16fcc47d6031e13a9dae563ec8efbcb3e56
-
SHA512
2e7f6348723e7d440df93e80bafa31ca4eb4cabf33d584466becce680ad3b596d538dc497fdb09060848b8514b2d9ec5d2b6a4d0d059344619885c334c916dd5
-
SSDEEP
12288:EOvtwqTEXNkYIYt8+jmfimuZNXO9YM4Dg9Ni8zr0HCUGFiFRSFGM8Ji9up4XyopP:XwqQKYIYW6+18tOqMQcNKF3H2eqiGs
Static task
static1
Behavioral task
behavioral1
Sample
0ee05e5c62ae8786f7d318ea48edf16fcc47d6031e13a9dae563ec8efbcb3e56.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
remcos
Eric-Host
craigjonson91211.freedynamicdns.net:2011
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
wee.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-3CS7D1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
qos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
0ee05e5c62ae8786f7d318ea48edf16fcc47d6031e13a9dae563ec8efbcb3e56
-
Size
1.0MB
-
MD5
0be2f1c22f5916d0cdb44ebccc39e18c
-
SHA1
731b7d2929de2b7d9a1a03f4372f4c5553c8e5ec
-
SHA256
0ee05e5c62ae8786f7d318ea48edf16fcc47d6031e13a9dae563ec8efbcb3e56
-
SHA512
2e7f6348723e7d440df93e80bafa31ca4eb4cabf33d584466becce680ad3b596d538dc497fdb09060848b8514b2d9ec5d2b6a4d0d059344619885c334c916dd5
-
SSDEEP
12288:EOvtwqTEXNkYIYt8+jmfimuZNXO9YM4Dg9Ni8zr0HCUGFiFRSFGM8Ji9up4XyopP:XwqQKYIYW6+18tOqMQcNKF3H2eqiGs
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-