Overview

overview

10

Static

static

3

msimg32.dll

windows7-x64

10

msimg32.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    msimg32.dll

  • Size

    2.6MB

  • Sample

    240710-qep5assapd

  • MD5

    f0c756cfdbef7ffa13cfda91edb1b8d1

  • SHA1

    9b2dd6c7eb954a2364ef2c2a463d152c6afdb7e1

  • SHA256

    68a144f4924faeadeb110c433d7b7afc5383a4c163704916e3e6c52f20bc449b

  • SHA512

    89f7a367a353e73d2afb574443a595f10acf609e3f3014e1fbcdb8dd356f569676dd657d68a575f99dc171a56d834cf4881db00c9331dfb3d2d15642fed12275

  • SSDEEP

    24576:cs17EV86bow9nnlC3RuHTqThZYe4u+k6neB6VOyxRaW5E4Y1PTNKTC9qIljCh/qv:c6Q0R2KMOydY1PTNmCgqjEea4DcnIz7H

Score
10/10
remcosremotehostpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

general7777.duckdns.org:6262

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-C3NHUV

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      msimg32.dll

    • Size

      2.6MB

    • MD5

      f0c756cfdbef7ffa13cfda91edb1b8d1

    • SHA1

      9b2dd6c7eb954a2364ef2c2a463d152c6afdb7e1

    • SHA256

      68a144f4924faeadeb110c433d7b7afc5383a4c163704916e3e6c52f20bc449b

    • SHA512

      89f7a367a353e73d2afb574443a595f10acf609e3f3014e1fbcdb8dd356f569676dd657d68a575f99dc171a56d834cf4881db00c9331dfb3d2d15642fed12275

    • SSDEEP

      24576:cs17EV86bow9nnlC3RuHTqThZYe4u+k6neB6VOyxRaW5E4Y1PTNKTC9qIljCh/qv:c6Q0R2KMOydY1PTNmCgqjEea4DcnIz7H

    Score
    10/10
    remcosremotehostpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks