Analysis Overview
SHA256
769e79005f9f65cf5eecc068fd142bec12879d45aae6c6f0404a079a12ef739a
Threat Level: Known bad
The file 1701849064ac095385a07377f6231c4a5ab01f6070adb38d9da668aed499e0c987abb42523360.dat-decoded was found to be: Known bad.
Malicious Activity Summary
Remcos family
Unsigned PE
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-12-06 07:53
Signatures
Remcos family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-06 07:53
Reported
2023-12-06 07:55
Platform
win7-20231023-en
Max time kernel
148s
Max time network
146s
Command Line
Signatures
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1701849064ac095385a07377f6231c4a5ab01f6070adb38d9da668aed499e0c987abb42523360.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\1701849064ac095385a07377f6231c4a5ab01f6070adb38d9da668aed499e0c987abb42523360.exe
"C:\Users\Admin\AppData\Local\Temp\1701849064ac095385a07377f6231c4a5ab01f6070adb38d9da668aed499e0c987abb42523360.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | remccoss2023.duckdns.org | udp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| US | 8.8.8.8:53 | remccoss2023.duckdns.org | udp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| US | 8.8.8.8:53 | remccoss2023.duckdns.org | udp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
Files
C:\ProgramData\remcos\registros.dat
| MD5 | acd5eae5b8b7e6d8d7a130ead018d479 |
| SHA1 | 0106ca8daae5182ce0cd8f26945b36e1add44db8 |
| SHA256 | fd76219fc1f28cd20272b1a1e7e009afc435ffc349c4d5be4ba12919d8003804 |
| SHA512 | 73ce2d7431179d3933212a64b6b00ebc820d7804e8f81a9139352d61916cfe1e17bc905e7a816972204f4e43d49a5c29087dfc0923b365c367fad4778a3a6931 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-06 07:53
Reported
2023-12-06 07:55
Platform
win10v2004-20231127-en
Max time kernel
150s
Max time network
146s
Command Line
Signatures
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1701849064ac095385a07377f6231c4a5ab01f6070adb38d9da668aed499e0c987abb42523360.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\1701849064ac095385a07377f6231c4a5ab01f6070adb38d9da668aed499e0c987abb42523360.exe
"C:\Users\Admin\AppData\Local\Temp\1701849064ac095385a07377f6231c4a5ab01f6070adb38d9da668aed499e0c987abb42523360.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 89.175.53.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.1.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | remccoss2023.duckdns.org | udp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| US | 8.8.8.8:53 | 41.175.53.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | remccoss2023.duckdns.org | udp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| US | 8.8.8.8:53 | remccoss2023.duckdns.org | udp |
| CO | 181.142.162.155:4576 | remccoss2023.duckdns.org | tcp |
| US | 8.8.8.8:53 | 169.117.168.52.in-addr.arpa | udp |
Files
C:\ProgramData\remcos\registros.dat
| MD5 | 6371dea18bcfbc70f89a95c187adf694 |
| SHA1 | cf2d00a554a0310a8db67c49c34f61f6b37230dc |
| SHA256 | f2a8ec7bed1a186ecaccff25338c7c0d64e052c98967b7c1f6d3808d49991345 |
| SHA512 | ec6045a43624f9cf6a26269a272d6c2f5fec4b19219bdbcf49cd98a29229a07e054e285bca5b0b81d49236fc6b552ed0a0c9ed17d2bcebfd0b2aa0c6506c8daa |