General

  • Target

    888-43-0x0000000073210000-0x0000000074272000-memory.dmp

  • Size

    16.4MB

  • MD5

    23d4b962650908ad1de8d130638d2108

  • SHA1

    3aa3284a1ff98d652c8d3cecab1c8bf169884679

  • SHA256

    6146b87a715241d6f693113c9de980a9991ae8d8259ae5a8e71d9a5a1a0ab33f

  • SHA512

    d8658e0484f31af1c9c13b4177da0655f5e77d5edc526d4ab9dcd6088621406f662835847dd3faa86fa1b94e45968af2f87ff281370a6986f9d2906819d616ed

  • SSDEEP

    12288:wux4hIt2YNeePmWLykxbdbs/ZyCWFi8v:4q2YNeeXbdeZ3WF

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

JOY

C2

tmsuccess.duckdns.org:4100

eweo9264gtuiort.duckdns.org:4100

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    joy.dat

  • keylog_flag

    false

  • keylog_folder

    joy

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Rmc-ULYK5N

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 888-43-0x0000000073210000-0x0000000074272000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections