Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
11/07/2023, 21:20
General
-
Target
tmp360697927.exe
-
Size
1.2MB
-
MD5
1e03d422a799d4b3ef2a13289ca04449
-
SHA1
0eac1bbe75e673c5e1390e16e901596a969c50ee
-
SHA256
6fba24dfea381c6717ff7a0f1fd62b4f66ef310ad42640f1121a4d4e4153e5d7
-
SHA512
ac81f662ddd52d61ba4750f6a16ea4a64efc54b86a7844bbf2b9a37169a908fa501ba8155bc56f9dae3a063574eef9f4839c2707ffebbc463ba49679b4793a2d
-
SSDEEP
12288:6PJgAVH5a/GLCK29+Bq5NB+HwxvG4KFoLGuDrpmSkkJSPGvjOsmy/ouaWLlxcg3c:6PZKTFE5Bt
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
151.106.15.158:4040
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2X8ZIA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp360697927.exe"C:\Users\Admin\AppData\Local\Temp\tmp360697927.exe"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB