Analysis
-
max time kernel
159s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
02-01-2024 16:06
General
-
Target
7ebaa52cdeaabaacd8608e677a28e211.exe
-
Size
373KB
-
MD5
7ebaa52cdeaabaacd8608e677a28e211
-
SHA1
1c9d3c12669285b93fcfac8519b55a63514c9526
-
SHA256
e40a8eec9b4c6e0136688ed0b406d751d955f412e373ace611bcf2d24239fe23
-
SHA512
7a6639b818f7b5a6b6fa5055f0f699d6a26cd4e875cf9c316dc76f6b5bc54c9b75d056bd17c8ff6acaf79c08e843278c2d035bd33adf2bc8b73093f5299f422a
-
SSDEEP
6144:5dg5n5DJJL7XJAnY7yo0nqsJ445mgy+sk8VAX8dN4pq:innJHX+nO8hJB5mKD8Z1
Score
10/10
Malware Config
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ebaa52cdeaabaacd8608e677a28e211.exe"C:\Users\Admin\AppData\Local\Temp\7ebaa52cdeaabaacd8608e677a28e211.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
400KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
32KB
-
Filesize
584KB
-
Filesize
7.7MB