Overview

overview

10

Static

static

3

0987654000090000.exe

windows7-x64

10

0987654000090000.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0987654000090000.pdf.rar

  • Size

    427KB

  • Sample

    231212-np72racbhp

  • MD5

    bc4ea25337c06e3b6edb046bf9effb06

  • SHA1

    135733805b799dae917532fa5660794c370a867a

  • SHA256

    5bf3f7baa22f254ac5dfd3383902f12f07706ecbd6913cff25548cb9c8f68c54

  • SHA512

    89a7bf04ddf4bd32686b8f9dbd6b63550c2b9d7970b799c0601c7a59bde442508612f8122a8a84f6be9c950bc187051146423776f6af2ff451c57cbc843bad63

  • SSDEEP

    6144:U9QMlrXW8HlVZBT7/vdd122plz0rOFIOpk9kne1yFOhxXBHTe5yzmnc/7JOxJS:qQMlrX3TZB7j12lrOuOpkxO4xgyzH78S

Score
10/10
remcosremotehostcollectionpersistenceratspywarestealerupx

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.175.229.139:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IZFV1M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      0987654000090000.BAT

    • Size

      463KB

    • MD5

      ac851f5b083c90453be2536fb7cf8eb0

    • SHA1

      65832ec449c430855a54607908d71d58896293ff

    • SHA256

      ac9790802a041c8d44f6bd430e0cc97ab9f452445aca1706acfe05851f7ce8a3

    • SHA512

      9914deaae2c36d9b61da41bcd7cc2152083b715c48423df9625183a829e61d244ba67794776ab2669975189fe28b5da65dde1d24f230613be784307767ff3fa6

    • SSDEEP

      6144:M8LxBwEVDPYW8JlHZB97/vh9122pfz0ryHoAtk9t/xiXT1yFahtXBpve5CzmTc/G:8uY3jZX7r12ZryIAtkvWpOstuCzJTHi

    Score
    10/10
    remcosremotehostcollectionpersistenceratspywarestealerupx

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks