Overview

overview

10

Static

static

1

Product In..._1.rtf

windows7-x64

10

Product In..._1.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Product Inquiry list_1.doc

  • Size

    40KB

  • Sample

    230629-hqya2scc39

  • MD5

    1f17c3775584429ef126cd4afb0ad7ca

  • SHA1

    87dd20bd063aeb6d345bb7e678f5feaf2d70c6f2

  • SHA256

    2490954c3b255bfb810b9552a52e58607dab2b9b5c2e551b1d0934583c11a603

  • SHA512

    52a97dd8bef40947659eedb2bd2c865c48b08d8fe3d8b7e399fd73f651219fa9fd9821a881abe47dc20a440ed047c7ecb50dc7e801d361081a8138a2bac5972c

  • SSDEEP

    768:8Fx0XaIsnPRIa4fwJMl8h5YLzbw106i7cK5d2/cip0gLvMTeIQ3btj:8f0Xvx3EMQ6zbw6J7cAYcu0gLEeIspj

Score
10/10
remcoslog persistencerat

Malware Config

Extracted

Family

remcos

Botnet

LOG

C2

5.253.114.108:2022

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    chromes.exe

  • copy_folder

    chromes

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-456ENB

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Product Inquiry list_1.doc

    • Size

      40KB

    • MD5

      1f17c3775584429ef126cd4afb0ad7ca

    • SHA1

      87dd20bd063aeb6d345bb7e678f5feaf2d70c6f2

    • SHA256

      2490954c3b255bfb810b9552a52e58607dab2b9b5c2e551b1d0934583c11a603

    • SHA512

      52a97dd8bef40947659eedb2bd2c865c48b08d8fe3d8b7e399fd73f651219fa9fd9821a881abe47dc20a440ed047c7ecb50dc7e801d361081a8138a2bac5972c

    • SSDEEP

      768:8Fx0XaIsnPRIa4fwJMl8h5YLzbw106i7cK5d2/cip0gLvMTeIQ3btj:8f0Xvx3EMQ6zbw6J7cAYcu0gLEeIspj

    Score
    10/10
    remcoslog persistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks