Overview

overview

10

Static

static

10

4140-14-0x...ry.exe

windows7-x64

4140-14-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    4140-14-0x0000000018360000-0x00000000183E2000-memory.dmp

  • Size

    520KB

  • MD5

    44f49d8d31a1989c0a19529c8e84c6b3

  • SHA1

    946709117eb846d2e0694a510c3ce12f10d198d0

  • SHA256

    28606e9e94ba098cc1f292e4048b8a52620fc495e0d0a45b2af2324a63062faa

  • SHA512

    c108087d1c7d25722704a95d189a4f18f4560760ec97036efd0b0bb03b6677ef0f12eac18414afd546e1282e996a23afe368582db484c4dedd78fd4166122142

  • SSDEEP

    6144:UO4ik/0eNucRr/+x2SeOVu6FDtJfCLwX9CQU0bub2jj4sAOZZbgXqcVy5Gv:U9/0SuQmQfcu45JfCLMCTK4s/ZbVcv

Score
10/10
may devotion 2024remcos

Malware Config

Extracted

Family

remcos

Botnet

MAY DEVOTION 2024

C2

pentester0.accesscam.org:56796

archived.zapto.org:56797

honeypotresearchteam.duckdns.org:13922
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    wetransfer.exe

  • copy_folder

    wetransfer

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    wetransfer

  • mouse_option

    false

  • mutex

    wetransfer-F4RIT7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4140-14-0x0000000018360000-0x00000000183E2000-memory.dmp
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections