Overview

overview

10

Static

static

6

Maryann 20...sc.pdf

windows7-x64

1

Maryann 20...sc.pdf

windows10-2004-x64

1

Maryann 20...er.exe

windows7-x64

1

Maryann 20...er.exe

windows10-2004-x64

10

Maryann 20...2m.dll

windows7-x64

1

Maryann 20...2m.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16599048558.zip

  • Size

    114.1MB

  • Sample

    240412-b2hleabe78

  • MD5

    f067d03452b98461f32ba26e026d36da

  • SHA1

    9be233d67272594f66c2c153197a68dc94673b79

  • SHA256

    a17b4a83e36a02f22d64cff10a32ddfa4756ad44334fa72079f6a11342b71e1b

  • SHA512

    abff20736a17fe7fad18e32b623e4e70a6770d0ec855db066bfad3a642af3bd1dd3fab72dc41549e401b8b4ce38f5b204acae01a78eb13cddebed93f655a24de

  • SSDEEP

    3145728:72OSc5Z3kfh2goXQW1xpFAQ44nddFZ+f577FBfD7SmeB5:7v1Z0WHmf57LFK

Score
10/10
remcosremotehostevasionpdfpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

ogbatobanana.duckdns.org:4047

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-0R92B3

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Maryann 2023 Tax Organizer/1099Misc.inf

    • Size

      130.0MB

    • MD5

      f158d3387c6e2cb1b482f7b7abee7e20

    • SHA1

      9aadedb8049339dd027a45bc733caa1f6f3dc7a9

    • SHA256

      c052369f476b624913e8aec1a3ba729d30b5d5f145c4c5c58d64f7d09cfa54b5

    • SHA512

      93e92533c93d966007eaf6fb35772e362326eb8bd321f1db28cfa98943277589a393081157a8832f162776127eb91974e3f93a2ea3475e936db1f228973bc40e

    • SSDEEP

      3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:

    Score
    1/10
    behavioral1behavioral2

    • Target

      Maryann 2023 Tax Organizer/Maryann TAX Organizer.exe

    • Size

      31KB

    • MD5

      3e71ed46603b02a94b921411a19b7a5c

    • SHA1

      b1374ef6717635d07015d8acb700cf95b2a66b12

    • SHA256

      1131f33552a12921f6f4d7d9e503feae4b12c367d5377e226acf270f6b58ca6e

    • SHA512

      28555a8bf20e4f8d42b21685c06e429bc5261f75e9fb65b970a322907d7da4a4ee7d367f4637ea4abb6ef32fae8e71a9d92b4f253a201e94548d68281edccbaf

    • SSDEEP

      384:e8Kj/M8yEryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2STcEICxXBhgBx4eMDa:eDD1r+VWOV+csoHViBBn+EFIqeMDGvaS

    Score
    10/10
    remcosremotehostpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral3behavioral4

    • Target

      Maryann 2023 Tax Organizer/g2m.dll

    • Size

      150.0MB

    • MD5

      3ceefa7bd30b2b5494c2cdb64342835c

    • SHA1

      ef4cad7600788cc696cec53480dcfb67a5143adb

    • SHA256

      e8eb6be89b47c2c5f4b61da460ae6c6d6bf150869624ad487df74b0d80351233

    • SHA512

      a3f88fae400037427d3068d583317c08132ff936c21c3fa38a97afedb9b614302228903973ed3aa8b41fb266f5e1aa3c7550ce4b4653ea9d4b1c06a0c350880f

    • SSDEEP

      786432:7UP7GCGO7b0Srkx/tC0SzIdSwh/WxbpNHQD3trzRp:7UP7GCG64Srkx1hSzYsHQD3t/R

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks