Analysis Overview
SHA256
3ae2a8fcc969ec131e6ea2387dbdbdc6dd9ef216fc4a04990a403b7a38494778
Threat Level: Known bad
The file 1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe was found to be: Known bad.
Malicious Activity Summary
Remcos family
Unsigned PE
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-04-05 13:55
Signatures
Remcos family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-05 13:55
Reported
2024-04-05 13:57
Platform
win7-20231129-en
Max time kernel
147s
Max time network
141s
Command Line
Signatures
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rxms.duckdns.org | udp |
| US | 89.117.23.25:57832 | rxms.duckdns.org | tcp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
Files
C:\ProgramData\remcos\logs.dat
| MD5 | 0b05df77394e8c1978ae30454a572ae0 |
| SHA1 | dfdc67bfd98b065b0f8fddf51aeb1552fb90f643 |
| SHA256 | 6ee31064a0153fa55e787aa97884c5c710a1358e0ab15c6b53879a81f73b3981 |
| SHA512 | a92c0307c9fbe777a85e7bbe3af045fb17548198034ad28456b8d2a69d36b9acc98ac2c8d58b72be09c5d98f5073a6a1ee9354f1ecbf4c354f81e565d04c34f3 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-05 13:55
Reported
2024-04-05 13:57
Platform
win10v2004-20240226-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rxms.duckdns.org | udp |
| US | 89.117.23.25:57832 | rxms.duckdns.org | tcp |
| US | 8.8.8.8:53 | 25.23.117.89.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| US | 8.8.8.8:53 | 152.136.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.33.237.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.118.77.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.136.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.179.89.13.in-addr.arpa | udp |
Files
C:\ProgramData\remcos\logs.dat
| MD5 | 2a1efddc929c9fd966b0c9854872b89b |
| SHA1 | 7d1e29e1d181f56ef679879c2743d6f8821746d0 |
| SHA256 | 0b4b6e516eecdd94f0fcea2b8bfd669a71301ebc63ed6410aaf234c1d2102550 |
| SHA512 | 4d5b1638b8933b2b2ebff8f9f92f24115c8db4d7e3e5724f05a5b7d470877a2bf294eb253105ffda716934894e5acbdadfff10730fcaf5ab5153c1e37c8f8175 |