General
-
Target
SecuriteInfo.com.Exploit.ShellCode.69.14498.22623.rtf
-
Size
72KB
-
Sample
240420-lkb3eadf25
-
MD5
bce2afb27ee0e6f7c7696384377941d9
-
SHA1
784949119f9a0e8f33a9a6d877de4af4723c7d27
-
SHA256
b2b8ef2a3bf64dd5531bd414e7f946c9f040ab2674bc73eb0d4af0d314623174
-
SHA512
f60b9990bc2309b6c3a364710964eb19206672e3c7c08bd7a02e145a0f33762536691e5c168a7c9844c35a2857a6be609283a96bbe08ab4bcd293ee5279a7c51
-
SSDEEP
1536:IXJHYanR12k0HtQ00cZ5iKBKEb0mNqgEmLDg8/RtPo8J6Xswq9i8uZYA5xOw0NXk:6Hn0HtQ00/KBKmNqglLE8Ztg8J6Xswqw
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Exploit.ShellCode.69.14498.22623.rtf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Exploit.ShellCode.69.14498.22623.rtf
Resource
win10v2004-20240412-en
Malware Config
Extracted
remcos
RemoteHost
sembe.duckdns.org:14645
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
notess
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-P0AEMX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
SecuriteInfo.com.Exploit.ShellCode.69.14498.22623.rtf
-
Size
72KB
-
MD5
bce2afb27ee0e6f7c7696384377941d9
-
SHA1
784949119f9a0e8f33a9a6d877de4af4723c7d27
-
SHA256
b2b8ef2a3bf64dd5531bd414e7f946c9f040ab2674bc73eb0d4af0d314623174
-
SHA512
f60b9990bc2309b6c3a364710964eb19206672e3c7c08bd7a02e145a0f33762536691e5c168a7c9844c35a2857a6be609283a96bbe08ab4bcd293ee5279a7c51
-
SSDEEP
1536:IXJHYanR12k0HtQ00cZ5iKBKEb0mNqgEmLDg8/RtPo8J6Xswq9i8uZYA5xOw0NXk:6Hn0HtQ00/KBKmNqglLE8Ztg8J6Xswqw
Score10/10-
Blocklisted process makes network request
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-