Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
-
submitted
29-03-2024 19:25
General
-
Target
Remcos-RAT-2022-main/Remcos Professional.exe
-
Size
6.5MB
-
MD5
1ecae7b88236fff686604c40f2ec8ef0
-
SHA1
5338d387c764b7da0a097e4dd38c17c603e62b08
-
SHA256
95a3f82e8e77aeb491d7faaf17c4f206763ff7eb08b8696e28ad109b67b984cf
-
SHA512
6a396bf98181250a2a386c2ee4dbcd8a4be6e23de029d614296e6f33a66b6f6049b487ef07d70936812c31f6cce7bb1b709361b749e0b1ad3507382b26c00a5c
-
SSDEEP
196608:CyDxS34Qskc93Uuze5VbN0Wp4ctz7Z9aVi:txb1kcWuzku84cNd
Malware Config
Signatures
-
Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos-RAT-2022-main\Remcos Professional.exe"C:\Users\Admin\AppData\Local\Temp\Remcos-RAT-2022-main\Remcos Professional.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5db1d47811a696dae50454abdbf8a9600
SHA1759f3944937d00cbddafdf32f06918cc57a026ce
SHA2564d2b0d33a5f4538c93c4cbd6ace75eef86a609ccfb59a810d897bb0b3b936ef7
SHA512b0112d67648ef1b69d758d125ec718d86e9e29c8324a9dd911b197b93faefb4dfdd9f48f46e534ec99b988d94d4d11fadee0d9be36fba7c59bbda5e860f67fa5
-
Filesize
25.3MB
-
Filesize
25.3MB