Analysis
-
max time kernel
30s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
05-05-2024 19:48
General
-
Target
Remcos-RAT-2022-main/Remcos Professional.exe
-
Size
6.5MB
-
MD5
1ecae7b88236fff686604c40f2ec8ef0
-
SHA1
5338d387c764b7da0a097e4dd38c17c603e62b08
-
SHA256
95a3f82e8e77aeb491d7faaf17c4f206763ff7eb08b8696e28ad109b67b984cf
-
SHA512
6a396bf98181250a2a386c2ee4dbcd8a4be6e23de029d614296e6f33a66b6f6049b487ef07d70936812c31f6cce7bb1b709361b749e0b1ad3507382b26c00a5c
-
SSDEEP
196608:CyDxS34Qskc93Uuze5VbN0Wp4ctz7Z9aVi:txb1kcWuzku84cNd
Malware Config
Signatures
-
Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos-RAT-2022-main\Remcos Professional.exe"C:\Users\Admin\AppData\Local\Temp\Remcos-RAT-2022-main\Remcos Professional.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD59bc0f2b7cc579db0abf900392518a300
SHA1bbaf4d5984c7da474f62ab5c608509cd0f681c98
SHA256816a39fc91348d98c4977328dd91c44d00a99a7b9e37500dfb8c3e8d73f5f0d0
SHA5122fb19602df689c8012510a560a4a8175383feee75764f0150ccf1a61113a2fa5bb9facd18c4a513ddb564e8961ba7e0f07325c183d743a32c3692b8326f64465
-
Filesize
25.3MB
-
Filesize
25.3MB