Overview

overview

10

Static

static

6999418460...67.exe

windows7-x64

10

6999418460...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8528321899.zip

  • Size

    1.4MB

  • Sample

    221205-1mk6esad85

  • MD5

    604f072295668e0d66fba8e9c4288439

  • SHA1

    e2358a70aa7b29da1053e9470503ce5c88804445

  • SHA256

    132bd4d8504eb976443884e5bbd55eda4108997b2e7eea370456dbc1485f058b

  • SHA512

    b8044b9e1bbd80d9010cdfb3edea4d9ac0e81e828d749617751abbb73615b2b5101acafabfd7e335bc75d71821b8072d416365821d6d3e6164dc7ce0556ba442

  • SSDEEP

    24576:yvUqJqeNoZ48MHuilxO6akngNtEYyRonxfmvrY7JLv9G6gzn7A9ALzirPIK9IaJ+:yTJ9MKkEni4R0fcrY7pvI6gj46i70aDM

Score
10/10
remcosgmgpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

GMG

C2

185.206.225.51:18853

127.0.0.1:18853

10.16.225.165:18853
Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-BJSRH8

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167

    • Size

      2.3MB

    • MD5

      bb9596b3f5c30793501d639848378712

    • SHA1

      20f3e55650c2dd10e3a38d35ab5a4a9cb4f83c2d

    • SHA256

      6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167

    • SHA512

      5781460eeae099457aa0c061974d2ed0c8d8953ecc03a8508a7d27483fc9d0083cc89b6eb81f78c22d6419fdbe422d104d31055a114ad39cc90446780f8c8316

    • SSDEEP

      49152:1zdHFRzHZ7Sg397xrwRRiFCyZglGDdzx2:XjzxSwaiF7ZXDdzx

    Score
    10/10
    remcosgmgpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks