Overview

overview

10

Static

static

1

e0075402df...cd.exe

windows7-x64

10

e0075402df...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0075402df87a8e617cc1a5ae341d864a910a4a25fa133b7a7254c4193e81dcd

  • Size

    6.1MB

  • Sample

    240524-ez3eksda93

  • MD5

    4f3ab78173728f3a0ee83cfedf9f584f

  • SHA1

    9b85f357aa0b3995ea5856c55b46e0e37cb43013

  • SHA256

    e0075402df87a8e617cc1a5ae341d864a910a4a25fa133b7a7254c4193e81dcd

  • SHA512

    32b8ecbfe4fc80c1e1d2007e6926c79b96d86cbfc8d5323035a31a9705bd7a370358592ee5a728119468b42d3145c6d205890736d677b1df779cfc64fd1ff727

  • SSDEEP

    49152:iDDFVHcYex2EIjwg5mSw9EOl3jQ2i5W0OJ6HH0Hk1qZejTg8TX7blVZgqjEBamN8:iP/LEiLMQ2t0OJ6Jq6kmRndqamRrr7K

Score
10/10
remcosfenixpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

FENIX

C2

abril04.con-ip.com:7770

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-MG1REZ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      e0075402df87a8e617cc1a5ae341d864a910a4a25fa133b7a7254c4193e81dcd

    • Size

      6.1MB

    • MD5

      4f3ab78173728f3a0ee83cfedf9f584f

    • SHA1

      9b85f357aa0b3995ea5856c55b46e0e37cb43013

    • SHA256

      e0075402df87a8e617cc1a5ae341d864a910a4a25fa133b7a7254c4193e81dcd

    • SHA512

      32b8ecbfe4fc80c1e1d2007e6926c79b96d86cbfc8d5323035a31a9705bd7a370358592ee5a728119468b42d3145c6d205890736d677b1df779cfc64fd1ff727

    • SSDEEP

      49152:iDDFVHcYex2EIjwg5mSw9EOl3jQ2i5W0OJ6HH0Hk1qZejTg8TX7blVZgqjEBamN8:iP/LEiLMQ2t0OJ6Jq6kmRndqamRrr7K

    Score
    10/10
    remcosfenixpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks