Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
08/05/2023, 23:36
General
-
Target
3c57d5f7a6ffbd19a90a26949b6b5339db98c3f072ee0f9c6284731846427c38.exe
-
Size
1.2MB
-
MD5
18d063109090761931e76b133b387f85
-
SHA1
4bd24679707873aa1f82b52d09c560c421f4a824
-
SHA256
3c57d5f7a6ffbd19a90a26949b6b5339db98c3f072ee0f9c6284731846427c38
-
SHA512
2cc7de194e585d423dad2a43e04d6dcd9707560cbba9b8272858fd9fa0fc3a536f1e1c9255c3256b86f0fd5e344bdf6d64f60be892c002dd5ef9f19d8f5d0e3d
-
SSDEEP
24576:bphZGfa+sFNMOaquakRGk8vIIBBtrUn3la6ysn6MwVXj:bxGi+s4OaXevII9A3lBn6XJ
Malware Config
Extracted
remcos
RemoteHost
spiderserver023.duckdns.org:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-9E2UMQ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c57d5f7a6ffbd19a90a26949b6b5339db98c3f072ee0f9c6284731846427c38.exe"C:\Users\Admin\AppData\Local\Temp\3c57d5f7a6ffbd19a90a26949b6b5339db98c3f072ee0f9c6284731846427c38.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZQcZri" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFAF.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\3c57d5f7a6ffbd19a90a26949b6b5339db98c3f072ee0f9c6284731846427c38.exe"{path}"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD59519f04a3097fe8f95e55125ddb5856a
SHA16087ea98486f99607aeeeb7294dca6110a99e8db
SHA25615b57e907b78c33a552ba1df200b700c73b4f95570df17692cdc026b15bf7337
SHA5120756e986776d9f6c2217c7b80a07389408c3ad0042e3e0ad8bc49aa446494d74baf5e9c69763d10dd3d283aa85598c936f5e3ba0399caf7e74a61abe27eecd3d
-
Filesize
1KB
MD5c47bfd99b6ada5464a91e3134c28161a
SHA16575a439a32f90330c696861efbc334c8764ffcc
SHA2566e43b89b30037d10d9eb476ed2d3272ceb24f832d1091be518989e9998bb7cb4
SHA512c3bb63f4dd472034cf26101958e83c71a22f39aec359736dc2d216c532069d7e0561e75eedb7738d7459384a7cecdb687403c0d3f3000c34baae87a422955f39
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
64KB