General

  • Target

    b6742722cc6fba8559adf5ebacff443d5953ff8f9fec8266f30ca2830112bebe

  • Size

    824KB

  • Sample

    230607-n62lasaa25

  • MD5

    8f29ce52fe5cd011fa6494d4ae13c8ce

  • SHA1

    5359e6dcf36389fb2f38edbecfcbbd9a932f84ce

  • SHA256

    b6742722cc6fba8559adf5ebacff443d5953ff8f9fec8266f30ca2830112bebe

  • SHA512

    5b3dbf648802373b87f37dc7b512564550b7c8ad2eff9557937912f0e5f2d19b6da485719a1766ffbe57833af56b55a398b8a3da660cabb06e4db6c69eb3f9ef

  • SSDEEP

    12288:BduXy5c5DIcGJoiBvCrWtfcsvc4qhuugSHv8icrHsjclyFmhV:Bdg8dcGJoJUfP7LzJlyFmh

Malware Config

Extracted

Family

remcos

Botnet

RECOVERY

C2

www.nwconstructions.us:28364

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    125484

  • mouse_option

    false

  • mutex

    wsdeeqd-JHHA9X

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      b6742722cc6fba8559adf5ebacff443d5953ff8f9fec8266f30ca2830112bebe

    • Size

      824KB

    • MD5

      8f29ce52fe5cd011fa6494d4ae13c8ce

    • SHA1

      5359e6dcf36389fb2f38edbecfcbbd9a932f84ce

    • SHA256

      b6742722cc6fba8559adf5ebacff443d5953ff8f9fec8266f30ca2830112bebe

    • SHA512

      5b3dbf648802373b87f37dc7b512564550b7c8ad2eff9557937912f0e5f2d19b6da485719a1766ffbe57833af56b55a398b8a3da660cabb06e4db6c69eb3f9ef

    • SSDEEP

      12288:BduXy5c5DIcGJoiBvCrWtfcsvc4qhuugSHv8icrHsjclyFmhV:Bdg8dcGJoJUfP7LzJlyFmh

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Tasks