Malware Analysis Report

2025-01-02 03:14

Sample ID 240405-q74s6adg7y
Target 1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe
SHA256 3ae2a8fcc969ec131e6ea2387dbdbdc6dd9ef216fc4a04990a403b7a38494778
Tags
remotehost remcos
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3ae2a8fcc969ec131e6ea2387dbdbdc6dd9ef216fc4a04990a403b7a38494778

Threat Level: Known bad

The file 1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe was found to be: Known bad.

Malicious Activity Summary

remotehost remcos

Remcos family

Unsigned PE

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-04-05 13:55

Signatures

Remcos family

remcos

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-05 13:55

Reported

2024-04-05 13:57

Platform

win7-20231129-en

Max time kernel

147s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe

"C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rxms.duckdns.org udp
US 89.117.23.25:57832 rxms.duckdns.org tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

C:\ProgramData\remcos\logs.dat

MD5 0b05df77394e8c1978ae30454a572ae0
SHA1 dfdc67bfd98b065b0f8fddf51aeb1552fb90f643
SHA256 6ee31064a0153fa55e787aa97884c5c710a1358e0ab15c6b53879a81f73b3981
SHA512 a92c0307c9fbe777a85e7bbe3af045fb17548198034ad28456b8d2a69d36b9acc98ac2c8d58b72be09c5d98f5073a6a1ee9354f1ecbf4c354f81e565d04c34f3

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-05 13:55

Reported

2024-04-05 13:57

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe

"C:\Users\Admin\AppData\Local\Temp\1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rxms.duckdns.org udp
US 89.117.23.25:57832 rxms.duckdns.org tcp
US 8.8.8.8:53 25.23.117.89.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 152.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 131.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

C:\ProgramData\remcos\logs.dat

MD5 2a1efddc929c9fd966b0c9854872b89b
SHA1 7d1e29e1d181f56ef679879c2743d6f8821746d0
SHA256 0b4b6e516eecdd94f0fcea2b8bfd669a71301ebc63ed6410aaf234c1d2102550
SHA512 4d5b1638b8933b2b2ebff8f9f92f24115c8db4d7e3e5724f05a5b7d470877a2bf294eb253105ffda716934894e5acbdadfff10730fcaf5ab5153c1e37c8f8175