General
-
Target
2188-91-0x0000000015AE0000-0x0000000016AE0000-memory.dmp
-
Size
16.0MB
-
Sample
240418-jt2nbafd75
-
MD5
7c933004bdc49d1e3c36ada581c3c6f8
-
SHA1
e0a9d8e669c16cdb942788585ffa8762425b7f9a
-
SHA256
779a641d39e6917ed1d350b430ade90ca121c827b119ecc9c700578ffdbb3adf
-
SHA512
d3d9b4d06f35fc1c07b6c9a6453efc88ca8d73bf9488d281cda07e0d1e10d27b6a544995fded0267eaf642ad98737d98e0771bd3f1f3358a6758d36d061050da
-
SSDEEP
6144:AvagcENRHQ2j4VGAQ08uZmE/8SRerIcX4kdZrNDsAOZZLkXTbcZU5Gv:AigNNN5sYv08OmE/8nrx3s/ZLwcv
Behavioral task
behavioral1
Sample
2188-91-0x0000000015AE0000-0x0000000016AE0000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2188-91-0x0000000015AE0000-0x0000000016AE0000-memory.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:47212
officerem.duckdns.org:47212
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-I8N3XG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
2188-91-0x0000000015AE0000-0x0000000016AE0000-memory.dmp
-
Size
16.0MB
-
MD5
7c933004bdc49d1e3c36ada581c3c6f8
-
SHA1
e0a9d8e669c16cdb942788585ffa8762425b7f9a
-
SHA256
779a641d39e6917ed1d350b430ade90ca121c827b119ecc9c700578ffdbb3adf
-
SHA512
d3d9b4d06f35fc1c07b6c9a6453efc88ca8d73bf9488d281cda07e0d1e10d27b6a544995fded0267eaf642ad98737d98e0771bd3f1f3358a6758d36d061050da
-
SSDEEP
6144:AvagcENRHQ2j4VGAQ08uZmE/8SRerIcX4kdZrNDsAOZZLkXTbcZU5Gv:AigNNN5sYv08OmE/8nrx3s/ZLwcv
Score1/10 -