Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08-04-2024 12:19
General
-
Target
3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811.exe
-
Size
1.3MB
-
MD5
1d779d40600de25a3e0bcf6953d2716e
-
SHA1
56c59c5f0cf6a074c4d2830b4475c3fd0b1ce2d1
-
SHA256
3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811
-
SHA512
7bb58f0cc67dba7dd8b33e06f6a775eba649680f104c5d097870bea88b108fa221891339cad1f8c4c1dfaf894380e65dd9d728aacbd4c0c0575ac8af949accff
-
SSDEEP
24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8aJUv3K/nmmUcgy+R+q:6TvC/MTQYxsWR7aJRnzUTzR
Malware Config
Extracted
remcos
RemoteHost
193.222.96.75:8823
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TNRDZX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811.exe"C:\Users\Admin\AppData\Local\Temp\3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Archimago\antholite.exe"C:\Users\Admin\AppData\Local\Temp\3c9065a948387b76124f035b405d3644ac960b18d8ca7b0437c02d8c98b8b811.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5a6551f70f5e73e1ff746a2162cd0ecae
SHA10cf40aa39f8782d74b76f19f87f674d71b272f53
SHA256baa791e8ebfcf63886a1904e65e8ebb520d99e4e82d6545337098e95e7307686
SHA512fff3fd5615afa8a547504ffc0bd9cedd2664fd7138f8c6358bc1e1c8f79f21810669dfee23abf47a339a39f735fbd97330c69280a38842bb3148cac83565198b
-
Filesize
104.3MB
MD59855059c02e864d44ce01783aa823e4b
SHA177ac3e90425bfbbc9553a7c91abe70b06d928afd
SHA25670b114ef436a2d8bc8f76ff0a9ebf9348a6b4fe7df2180d1536952c087ceb91f
SHA512752a35e3f96ee0803a56eb640c12ac09ef3ac4ea928e2014043d62e4d93575012755cfd4a4ef34a79ffef762a37b114d4ba25ff1cb13437175fcd09ad8e0a584
-
Filesize
29KB
MD56ab1c336cc31c275489f031d8d48e74b
SHA1fd0a211434df571099c5e6387f446f87b9e71a9d
SHA256ac04026bf644efd9ad1d3c939624d3a0394a22726a730e3c3250d0d10cda5898
SHA512ce19f57c86b62955f7049d8479f43584fecea46bfbd7e554d502dbf89a51b9676376e1678292c1aa4eec1bcb555670f34b34dfa20b63ebb9b80a918cdbc55861
-
Filesize
482KB
MD57116dd94279c33e80b987344d27b53e4
SHA178c3aa04a477f17b2e9c157663ceb99765690986
SHA256b747286ea89931d724a30cbc007400f956a76bedc1b61c4213b97d1fa4dc29e0
SHA51264698773a5961c70e74dfe432a569c756d6c4868080ea95c0dd14f3c90878643626439d6dc411de879fab84dd2ee0a415666143fb1c3b0cb7f9281b161dc5773
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
16KB