General

  • Target

    New Order 67789034.doc

  • Size

    139KB

  • Sample

    240325-e4xd5agb37

  • MD5

    ecee6aa34fbc3160da85977ea06635f4

  • SHA1

    0c6a034464795919fc152f00b8ce8fe5af3f153b

  • SHA256

    ff764765692f15e596b66329082f7cc73df9ab95a3af04ddf42e7d0f57c11fef

  • SHA512

    7a2918ee0e3bec5211749b1a3093f2232d51cf2077d9114a6304fe38c30a938c439e7dd2d1d2c4435d2b5d5b2b99788a58c2367c7f3cfa3d4da696f12e18d5b2

  • SSDEEP

    1536:ewAlRkwAlRkwAlR4U/1v5JUPAbvSpf9MxFWU/G:ewAlawAlawAlm2vPUPAbvSpf22UO

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

194.147.140.150:5213

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-PBR5WH

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      New Order 67789034.doc

    • Size

      139KB

    • MD5

      ecee6aa34fbc3160da85977ea06635f4

    • SHA1

      0c6a034464795919fc152f00b8ce8fe5af3f153b

    • SHA256

      ff764765692f15e596b66329082f7cc73df9ab95a3af04ddf42e7d0f57c11fef

    • SHA512

      7a2918ee0e3bec5211749b1a3093f2232d51cf2077d9114a6304fe38c30a938c439e7dd2d1d2c4435d2b5d5b2b99788a58c2367c7f3cfa3d4da696f12e18d5b2

    • SSDEEP

      1536:ewAlRkwAlRkwAlR4U/1v5JUPAbvSpf9MxFWU/G:ewAlawAlawAlm2vPUPAbvSpf22UO

    Score
    10/10
    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks