Overview

overview

10

Static

static

1

6a2bece56f...a8.rtf

windows7-x64

10

6a2bece56f...a8.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a2bece56fe02b45d810a7bee948a695a546fa20d6a41059881e4f5cd8d3c1a8.rtf

  • Size

    73KB

  • Sample

    240419-bwz89scg74

  • MD5

    f2f68348f362c4e57a14b9c05e2e8e9f

  • SHA1

    4a7ea1d1dc020f606a71ec2dc180797c4399b226

  • SHA256

    6a2bece56fe02b45d810a7bee948a695a546fa20d6a41059881e4f5cd8d3c1a8

  • SHA512

    1e469d0e2b40425a62a6fff84d4f06d25e5dbebc62ed296b272640ce731b28706aa54807da4d1074c9d0aa5b9c1e3278c38a1f72bf1429e548806b03f0532611

  • SSDEEP

    1536:9istY3tmRjSnQZdvPHLXEc5J1jQ1bL+jmfkOXAC3qrsGYX3wmPC+tJJROtgIrsJH:9irtmRyOvPHLXB5J1jQ1bL+jukW3qrod

Score
10/10
remcoszynovapersistencerat

Malware Config

Extracted

Family

remcos

Botnet

Zynova

C2

remcjulia.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-76C83U

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      6a2bece56fe02b45d810a7bee948a695a546fa20d6a41059881e4f5cd8d3c1a8.rtf

    • Size

      73KB

    • MD5

      f2f68348f362c4e57a14b9c05e2e8e9f

    • SHA1

      4a7ea1d1dc020f606a71ec2dc180797c4399b226

    • SHA256

      6a2bece56fe02b45d810a7bee948a695a546fa20d6a41059881e4f5cd8d3c1a8

    • SHA512

      1e469d0e2b40425a62a6fff84d4f06d25e5dbebc62ed296b272640ce731b28706aa54807da4d1074c9d0aa5b9c1e3278c38a1f72bf1429e548806b03f0532611

    • SSDEEP

      1536:9istY3tmRjSnQZdvPHLXEc5J1jQ1bL+jmfkOXAC3qrsGYX3wmPC+tJJROtgIrsJH:9irtmRyOvPHLXB5J1jQ1bL+jukW3qrod

    Score
    10/10
    remcoszynovapersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks