Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
06-01-2024 22:40
General
-
Target
Remcos Professional.exe
-
Size
6.5MB
-
MD5
1ecae7b88236fff686604c40f2ec8ef0
-
SHA1
5338d387c764b7da0a097e4dd38c17c603e62b08
-
SHA256
95a3f82e8e77aeb491d7faaf17c4f206763ff7eb08b8696e28ad109b67b984cf
-
SHA512
6a396bf98181250a2a386c2ee4dbcd8a4be6e23de029d614296e6f33a66b6f6049b487ef07d70936812c31f6cce7bb1b709361b749e0b1ad3507382b26c00a5c
-
SSDEEP
196608:CyDxS34Qskc93Uuze5VbN0Wp4ctz7Z9aVi:txb1kcWuzku84cNd
Malware Config
Signatures
-
Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5f01898bdda6bafb67fb5677658c315c2
SHA133c16585f009767e10ba634fb6d468f938f54b17
SHA256a4b4a538982e840c822a94b37852bad5f6f2b34d5fda4038f6fb4ef2368949c7
SHA5121f0bffd4ee7e474e17d30b22cded8a3c54d8c608e6acfce7df178fa92064b5b72df5c5573327e09f098eb379b01178e1fc8d7d7f6b475b8e4fe1c451d3fb2dad
-
Filesize
25.3MB
-
Filesize
25.3MB