Overview

overview

10

Static

static

3

AWB-RO-202...73.exe

windows7-x64

AWB-RO-202...73.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AWB-RO-202644066004734534543534534563456784576373.exe

  • Size

    704KB

  • Sample

    240214-lnsjkagb59

  • MD5

    2bf4f7c342a2d3e07f3685b2334f4749

  • SHA1

    ce2fc2a2899b4302ce2d55f732039240cc70529b

  • SHA256

    dcf86088586837cd7d690592bcd0a38c7bfd807b22b0a975da1a8773e551983a

  • SHA512

    b134b95882e7c67c636408fd874ab22f5c15e1965c525cf576df0bf45c56b0b7401c4e616e412682632174c0ac2ac51c3f73dd831e974181da548623ca311c82

  • SSDEEP

    12288:PK5yuMYw7lskuR1fi+6wFF0JC2RTfuBZL+HlLwxOiMCyINCj:C5XMYwZluR10bJ4uHlLhlIkj

Score
10/10
guloaderremcosdownloaderpersistencerat

Malware Config

Targets

    • Target

      AWB-RO-202644066004734534543534534563456784576373.exe

    • Size

      704KB

    • MD5

      2bf4f7c342a2d3e07f3685b2334f4749

    • SHA1

      ce2fc2a2899b4302ce2d55f732039240cc70529b

    • SHA256

      dcf86088586837cd7d690592bcd0a38c7bfd807b22b0a975da1a8773e551983a

    • SHA512

      b134b95882e7c67c636408fd874ab22f5c15e1965c525cf576df0bf45c56b0b7401c4e616e412682632174c0ac2ac51c3f73dd831e974181da548623ca311c82

    • SSDEEP

      12288:PK5yuMYw7lskuR1fi+6wFF0JC2RTfuBZL+HlLwxOiMCyINCj:C5XMYwZluR10bJ4uHlLhlIkj

    Score
    10/10
    guloaderremcosdownloaderpersistencerat

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      9625d5b1754bc4ff29281d415d27a0fd

    • SHA1

      80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

    • SHA256

      c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

    • SHA512

      dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

    • SSDEEP

      192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks