Overview

overview

10

Static

static

3

SİPARİS4...55.exe

windows7-x64

10

SİPARİS4...55.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2023 11:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SİPARİS450021722274015255.exe

  • Size

    468KB

  • MD5

    be3ae4e0fb6eaaabce5f55ea744e42b1

  • SHA1

    789cfd4656fd675c23dbfbe5fb98897e0bb6d513

  • SHA256

    d18b801304d7360b0e2653ada5e71b50360d01f9b6a79002257b122f48bce1d6

  • SHA512

    edac73a3ebd87a7ce76651d9770cccce0acfe847ce97a08546372cff0d9437d8561907fa740f7335887bcd4ff97c211ab0bebee912e90e180d9efca247a8ecb5

  • SSDEEP

    12288:YYBJd1T0KBiJMYhZaJbyYJ1DSNLClNRSuiQX:YYBJ30caMYhZaJTSNLClNPiQ

Score
10/10
remcosdecemberrat

Malware Config

Extracted

Family

remcos

Botnet

december

C2

91.92.243.110:3734

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-QGHS48

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SİPARİS450021722274015255.exe
    "C:\Users\Admin\AppData\Local\Temp\SİPARİS450021722274015255.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat
    Filesize

    144B

    MD5

    34fb6e7e751a288a96c870e5d6a1fcd7

    SHA1

    64e4718b924a8501c4a90a2842819e02ca857dcd

    SHA256

    edf7a8f1770221287394be55679ea8e57b79abaf2b018c634a267ad5d33f55ec

    SHA512

    8708da872041d9202c8a1faed629289f9f43198693068ae3f6e019bbc77c243deca61b1e29fba5a6069e584e31a4fb974532f5301738a0010145558824dc10cf

    Download Submit
  • memory/2124-19-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-46-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-17-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-8-0x00000000002B0000-0x00000000003B0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/2124-10-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-11-0x00000000009A0000-0x0000000000A1A000-memory.dmp
    Filesize

    488KB

    Download
  • memory/2124-2-0x00000000009A0000-0x0000000000A1A000-memory.dmp
    Filesize

    488KB

    Download
  • memory/2124-14-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-5-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-3-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-26-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-23-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-29-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-31-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-34-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-38-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-41-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-43-0x0000000000400000-0x0000000000926000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/2124-1-0x00000000002B0000-0x00000000003B0000-memory.dmp
    Filesize

    1024KB

    Download