Overview

overview

10

Static

static

10

Request Fo...on.exe

windows7-x64

10

Request Fo...on.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Request For Quotation.arj

  • Size

    3KB

  • Sample

    230130-tahffacf3x

  • MD5

    70a7b1e9a3f5e6b9f7f162e7ddef6f64

  • SHA1

    6738d5c1030486fd0972b12945c514462949a4e0

  • SHA256

    3bbf20bc61651bac3e5826cdea62a17287b85f5a738dccfba46dacdf1baec5f8

  • SHA512

    4f2a0fb1015a98604ec7535bf00c4a838572868e91537d8c5f3ed0742d9a35353275d390a41d7ea5f7786cb1e25d032fe72b6643425ad2c988d90feaade4a219

Score
10/10
purecrypterremcos28282downloaderloaderpersistencerat

Malware Config

Extracted

Family

purecrypter

C2

http://194.180.49.17/Pruwgxlsz.bmp

Extracted

Family

remcos

Botnet

28282

C2

194.180.49.17:28282

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    gqhwjekrltlu-TOU33Q

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Request For Quotation.exe

    • Size

      6KB

    • MD5

      1b7fda525abb7145a0cf5099a2bb0124

    • SHA1

      5f0445d82f2f59d66d74df0f321bcd63023a87c5

    • SHA256

      85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b

    • SHA512

      8e212b39215328bac75782340957ac71b3fb22f444f7ad18b14eae1a483c0413e870b677cfb48e850a9c4cc5ef182e6d1ae796d4bb7cbaf16446983c06a0d5b1

    • SSDEEP

      96:rmc26N/JsNp8syjxQbw3kBFWkhL6CFRQt15vr3F6JNQikFtCaX/BzNt:rfJRW8HxswUnWaL6YG5vDMoFbX/D

    Score
    10/10
    purecrypterremcos28282downloaderloaderpersistencerat

    • Detect PureCrypter injector

      loader

    • Modifies WinLogon for persistence

      persistence

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

      loaderdownloaderpurecrypter

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks