General

  • Target

    5384-39-0x0000000001200000-0x0000000002454000-memory.dmp

  • Size

    10.8MB

  • Sample

    240212-vbamnaca22

  • MD5

    6f38432eef0301e408a5be7e02bb046e

  • SHA1

    c697ba5df2850b6965c230e8dae430bdb15d7991

  • SHA256

    6531f379bf99de74d176774560cc80a4f3a51e461ab7485f97eec2a51145e980

  • SHA512

    0a3e8a1696a3fb67628bbc6d8f1fc18906065bdb15bc82cba650a5444ceefa8ba711e5200270708430a008972adab04cfff02fd1070e3caf0ba54eff752332b7

  • SSDEEP

    6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHR2sAOZZsAX4cNc5Gv:8X7tPMK8ctGe4Dzl4h2Qnu72s/Zs5cv

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

Top

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    mqerms.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    alpwovnb-G3F5OR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      5384-39-0x0000000001200000-0x0000000002454000-memory.dmp

    • Size

      10.8MB

    • MD5

      6f38432eef0301e408a5be7e02bb046e

    • SHA1

      c697ba5df2850b6965c230e8dae430bdb15d7991

    • SHA256

      6531f379bf99de74d176774560cc80a4f3a51e461ab7485f97eec2a51145e980

    • SHA512

      0a3e8a1696a3fb67628bbc6d8f1fc18906065bdb15bc82cba650a5444ceefa8ba711e5200270708430a008972adab04cfff02fd1070e3caf0ba54eff752332b7

    • SSDEEP

      6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHR2sAOZZsAX4cNc5Gv:8X7tPMK8ctGe4Dzl4h2Qnu72s/Zs5cv

    Score
    1/10

MITRE ATT&CK Matrix

Tasks