Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
13-05-2024 09:43
General
-
Target
8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433.exe
-
Size
2.4MB
-
MD5
6e409c732339d8d71f87666d591f9856
-
SHA1
d9c0a478f02642fbbbc1c3739f765a754e7fad78
-
SHA256
8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433
-
SHA512
7a16b1e81379a2ad666b6c4ef5ebf610c5d63a6eecdb7452ac98e83da50cca5cbd4395fb41a0dec7f94fb92f16da2d32de45d8eb11585aaa3739c155a5e5971d
-
SSDEEP
49152:zlVv/kvowwe0hJzJiwK+zM5awNMaL2TQG9ivR6jfu4Wv+eys1n0qdT0luyKYA:L/g0hJzHzXvTQGfjfu5Ty006xy
Malware Config
Extracted
remcos
spacolombia
areaseguras.con-ip.com:2701
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
loggsd
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc12145501-WMWIXV
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detect ZGRat V1 34 IoCs
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433.exe"C:\Users\Admin\AppData\Local\Temp\8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433.exe"C:\Users\Admin\AppData\Local\Temp\8ff4e6a59790f11138b89b4f5a946c00d6259f17b0bb88b2b808f8b0676e3433.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD584a8de26e5d9d3ff44bc79f5d64a7eb5
SHA1bdd43588d7dfe50adb66436143c0a1dfa43acb23
SHA2562c678897f32f30860794e5131914c6788cf86c90c1cf985f553cf76d73471f9e
SHA5129730782d77ed2ed569e2a3c1786326fc0cff60a65405d81f21827833757ae837eb79f2dca0af5984ce241795c3ec5de5bb54994520c016b6ccb5d0998c2e4f95
-
Filesize
270B
MD5131e146d8cabcf16a2e392a0a4fc5ca6
SHA15166fea833a9960452f7cf8dd42dc1792617a1a5
SHA256c61072282dee5ab80c8cd29e7c3aae5f8a5f5ea66cd42991bd917911192a9761
SHA512f7acecaa2df992bc297ec544c1b84a3748d712743f6221929abac8c66c4fa364006836ba6ddd5b2473d295bbc4d433173c3382347c8e1f89e30879e567db17ba
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
4KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
616KB
-
Filesize
304KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
336KB
-
Filesize
2.3MB
-
Filesize
6.9MB
-
Filesize
2.3MB
-
Filesize
2.4MB
-
Filesize
2.4MB