General

  • Target

    6b21cf5ebc20615576167925b27adad49dd095dbca80a7a47101fa824295057c.exe

  • Size

    1.1MB

  • Sample

    240809-wjj2qsxdjc

  • MD5

    27bff21251401bdc53507869909489ac

  • SHA1

    9799ac564ccff08975c682be7f9f300bafb452c7

  • SHA256

    6b21cf5ebc20615576167925b27adad49dd095dbca80a7a47101fa824295057c

  • SHA512

    eb6269a0355fa5fef9f34cc13d81ad44c5a44b9a81dfdbe0f88ccc2474988239d1384adb6745abe8e572f1a9a5478dea99d220864e4182b906448dfe4086e5ba

  • SSDEEP

    24576:w5drKL26BWweIJ37Lb2Sr7vTYEg2ELQtQJFBXhNw2aJm:wqS6BESySr/Yr2BQV

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

104.250.180.178:7902

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Adobe.exe

  • copy_folder

    Adobe

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Adobe-OTOIRK

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      6b21cf5ebc20615576167925b27adad49dd095dbca80a7a47101fa824295057c.exe

    • Size

      1.1MB

    • MD5

      27bff21251401bdc53507869909489ac

    • SHA1

      9799ac564ccff08975c682be7f9f300bafb452c7

    • SHA256

      6b21cf5ebc20615576167925b27adad49dd095dbca80a7a47101fa824295057c

    • SHA512

      eb6269a0355fa5fef9f34cc13d81ad44c5a44b9a81dfdbe0f88ccc2474988239d1384adb6745abe8e572f1a9a5478dea99d220864e4182b906448dfe4086e5ba

    • SSDEEP

      24576:w5drKL26BWweIJ37Lb2Sr7vTYEg2ELQtQJFBXhNw2aJm:wqS6BESySr/Yr2BQV

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks