Overview

overview

10

Static

static

1

Ref_FTD431100.xls

windows7-x64

10

Ref_FTD431100.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ref_FTD431100.xls

  • Size

    244KB

  • Sample

    240524-fz1fnaeg87

  • MD5

    a3c487cd79a32dc056ac50e644d47b67

  • SHA1

    1dd4807ba8b7f99c730d56990b9b1bb188d12e25

  • SHA256

    08f8f68b340189648071307dc98770ddf065c25cffb8be77ede5ef463519fdc8

  • SHA512

    76d297f60151f59f44aeeda559d70659551d144147c3cedb2c717009dce73e1ffe397e0a41f59c62064e4b45153afbd5e22c208b233dbc40fe60c4c35fe2eb22

  • SSDEEP

    6144:qe4UcLe0JOqPQZR8MDdATCR3tSjAmmCUKI4LX2iiITp:IUP/qPQZR8MxAm/ScmW41iITp

Score
10/10
remcosremotehostcollectionexecutionpersistenceratspywarestealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

trutru.duckdns.org:1199

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    fsfgdgdfgfd

  • mouse_option

    false

  • mutex

    Rmc-DBKAS1

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Ref_FTD431100.xls

    • Size

      244KB

    • MD5

      a3c487cd79a32dc056ac50e644d47b67

    • SHA1

      1dd4807ba8b7f99c730d56990b9b1bb188d12e25

    • SHA256

      08f8f68b340189648071307dc98770ddf065c25cffb8be77ede5ef463519fdc8

    • SHA512

      76d297f60151f59f44aeeda559d70659551d144147c3cedb2c717009dce73e1ffe397e0a41f59c62064e4b45153afbd5e22c208b233dbc40fe60c4c35fe2eb22

    • SSDEEP

      6144:qe4UcLe0JOqPQZR8MDdATCR3tSjAmmCUKI4LX2iiITp:IUP/qPQZR8MxAm/ScmW41iITp

    Score
    10/10
    remcosremotehostcollectionexecutionpersistenceratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Abuses OpenXML format to download file from external location

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks