General
-
Target
Request For Quotation.exe
-
Size
6KB
-
Sample
230131-lcf2dsfg83
-
MD5
1b7fda525abb7145a0cf5099a2bb0124
-
SHA1
5f0445d82f2f59d66d74df0f321bcd63023a87c5
-
SHA256
85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b
-
SHA512
8e212b39215328bac75782340957ac71b3fb22f444f7ad18b14eae1a483c0413e870b677cfb48e850a9c4cc5ef182e6d1ae796d4bb7cbaf16446983c06a0d5b1
-
SSDEEP
96:rmc26N/JsNp8syjxQbw3kBFWkhL6CFRQt15vr3F6JNQikFtCaX/BzNt:rfJRW8HxswUnWaL6YG5vDMoFbX/D
Behavioral task
behavioral1
Sample
Request For Quotation.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Request For Quotation.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
purecrypter
http://194.180.49.17/Pruwgxlsz.bmp
Extracted
remcos
28282
194.180.49.17:28282
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
gqhwjekrltlu-TOU33Q
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Request For Quotation.exe
-
Size
6KB
-
MD5
1b7fda525abb7145a0cf5099a2bb0124
-
SHA1
5f0445d82f2f59d66d74df0f321bcd63023a87c5
-
SHA256
85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b
-
SHA512
8e212b39215328bac75782340957ac71b3fb22f444f7ad18b14eae1a483c0413e870b677cfb48e850a9c4cc5ef182e6d1ae796d4bb7cbaf16446983c06a0d5b1
-
SSDEEP
96:rmc26N/JsNp8syjxQbw3kBFWkhL6CFRQt15vr3F6JNQikFtCaX/BzNt:rfJRW8HxswUnWaL6YG5vDMoFbX/D
-
Detect PureCrypter injector
-
Modifies WinLogon for persistence
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-