General

  • Target

    2680-0-0x0000000000400000-0x0000000000482000-memory.dmp

  • Size

    520KB

  • Sample

    240724-pd3tbsyckf

  • MD5

    b9e442e35d6900c1a0e0d5e5dfc56b63

  • SHA1

    e6c69725e62ea5304d64d804e490b5bf7f5ba2be

  • SHA256

    7f9a9d59e378411c16ab8c1e38f5abd97caffbc712ea35b1532a84556e4ec6bb

  • SHA512

    de540275f8c763e1094b1b86de5775ff60a079e8eca4a426efaa123d421a72a38ae11b6d2ba621433a73071e72fb5ebc499fb7a5fae7c176d865d5819cebb817

  • SSDEEP

    6144:wXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZoAX0cNF5Gv:wX7tPMK8ctGe4Dzl4h2QnuPs/Zo8cv

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

2556

C2

bossnacarpet.com:2556

vegetachcnc.com:2556

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    chrome-6W1HCC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      2680-0-0x0000000000400000-0x0000000000482000-memory.dmp

    • Size

      520KB

    • MD5

      b9e442e35d6900c1a0e0d5e5dfc56b63

    • SHA1

      e6c69725e62ea5304d64d804e490b5bf7f5ba2be

    • SHA256

      7f9a9d59e378411c16ab8c1e38f5abd97caffbc712ea35b1532a84556e4ec6bb

    • SHA512

      de540275f8c763e1094b1b86de5775ff60a079e8eca4a426efaa123d421a72a38ae11b6d2ba621433a73071e72fb5ebc499fb7a5fae7c176d865d5819cebb817

    • SSDEEP

      6144:wXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZoAX0cNF5Gv:wX7tPMK8ctGe4Dzl4h2QnuPs/Zo8cv

    Score
    1/10

MITRE ATT&CK Matrix

Tasks