Overview

overview

10

Static

static

1

Setup.exe

windows7-x64

10

Setup.exe

windows10-2004-x64

10

datastate.dll

windows7-x64

1

datastate.dll

windows10-2004-x64

3

madbasic_.dll

windows7-x64

1

madbasic_.dll

windows10-2004-x64

1

maddisAsm_.dll

windows7-x64

1

maddisAsm_.dll

windows10-2004-x64

1

madexcept_.dll

windows7-x64

1

madexcept_.dll

windows10-2004-x64

1

rtl120.dll

windows7-x64

1

rtl120.dll

windows10-2004-x64

1

sqlite3.dll

windows7-x64

3

sqlite3.dll

windows10-2004-x64

3

vcl120.dll

windows7-x64

1

vcl120.dll

windows10-2004-x64

1

vclx120.dll

windows7-x64

3

vclx120.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2
  • Size 3.9MB
  • Sample240723-ldq8raydja
  • SHA256 c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
remcosfudstubrat

Malware Config

Extracted

Family

  • remcos

Botnet

  • fudstub

C2

  • 213.5.130.58:443

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    Crashreport

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Rmc-0H4R64

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target
      Setup.exe
    • Size 2.0MB
    • SHA256 5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    remcosfudstubrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      datastate.dll
    • Size 75KB
    • SHA256 6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4
    • Target
      madbasic_.bpl
    • Size 209KB
    • SHA256 d6d5ff8e9dc6d2b195a6715280c2f1ba471048a7ce68d256040672b801fda0ea
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      maddisAsm_.bpl
    • Size 61KB
    • SHA256 52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      madexcept_.bpl
    • Size 435KB
    • SHA256 835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral9
    • Target
      rtl120.bpl
    • Size 1.1MB
    • SHA256 b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      sqlite3.dll
    • Size 904KB
    • SHA256 02f37a8e3d1790ac90c04bc50de73cd1a93e27caf833a1e1211b9cc6294ecee5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral13behavioral14
    • Target
      vcl120.bpl
    • Size 1.9MB
    • SHA256 b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      vclx120.bpl
    • Size 220KB
    • SHA256 2bdf023c439010ce0a786ec75d943a80a8f01363712bbf69afc29d3e2b5306ed
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks