Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
21/08/2024, 09:27
General
-
Target
b833db95708c829952de0ab64c287541fdc039d70d6d5f57ed705c7ee0b435fe.exe
-
Size
1.3MB
-
MD5
3a24f085a5bc458b449ddb54fa2386d4
-
SHA1
5186dff78d989fece2317d3c308ddbab99e84361
-
SHA256
b833db95708c829952de0ab64c287541fdc039d70d6d5f57ed705c7ee0b435fe
-
SHA512
cedac0eba0b0e93caf68acefa9d66969836be0f7860d9603725ce183c90600ca252e5940558981459ee16c656035bd52ea84c47aa532200a59560d3bdaaad88e
-
SSDEEP
24576:vqDEvCTbMWu7rQYlBQcBiT6rprG8aZ7hUzUlcybrMUUY8:vTvC/MTQYxsWR7aZyVy8nY
Malware Config
Extracted
remcos
gasplant
whitelend-ind.com:30901
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Chrome
-
mouse_option
false
-
mutex
chrome-7EL1DB
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b833db95708c829952de0ab64c287541fdc039d70d6d5f57ed705c7ee0b435fe.exe"C:\Users\Admin\AppData\Local\Temp\b833db95708c829952de0ab64c287541fdc039d70d6d5f57ed705c7ee0b435fe.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\directory\chrome.exe"C:\Users\Admin\AppData\Local\Temp\b833db95708c829952de0ab64c287541fdc039d70d6d5f57ed705c7ee0b435fe.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD55919585e07a6d10bffc822affa15ee04
SHA1d05b2a08031388b641597123a159ee54bb4a1237
SHA256631b2db50765d5c24e290143e33d28d1a4571d743708d6c03154d70a38f5943c
SHA5122172bebade7ec37ac7646766b32f3126d0c2f5038af53a9580068b2aab7e2194e59a69dfb117d33dfca18f74733261903ca5b1c795e75434e7cf9f5cda0e1238
-
Filesize
84KB
MD5cb0d03a966c28a6249d47ca9fd3a6296
SHA15672654bea07caf3e398e16a26e5f540c39de898
SHA25604da214567a6820dfd17868b10c011193f89dcac573fb4aee24325208b304605
SHA512291853903f7f0ef21a200583ebd6b06cb38a3a6817487cb6c05a652bebfdaabdc5062b93c85443ae4bbe701115e0357dd4c67c467e4723abc2af925dac8b5639
-
Filesize
483KB
MD55d04eed87d21d597b980e79949c595ba
SHA13701ccf4055b959b487fa311a9b241060305b6ca
SHA2567201d277c34403811912a48da6d17f5a826ba10cffcd61ef7bafe7dcf28e5e1a
SHA512556a6a6fbaf9ec6eeb3b8636e9942c4132d309b5f6cab3675b7f38134d0e75ac9ddb685f187efa693cca33d9cea4bb9991e282ee1777de67da02cdd94633623b
-
Filesize
1.3MB
MD53a24f085a5bc458b449ddb54fa2386d4
SHA15186dff78d989fece2317d3c308ddbab99e84361
SHA256b833db95708c829952de0ab64c287541fdc039d70d6d5f57ed705c7ee0b435fe
SHA512cedac0eba0b0e93caf68acefa9d66969836be0f7860d9603725ce183c90600ca252e5940558981459ee16c656035bd52ea84c47aa532200a59560d3bdaaad88e
-
Filesize
16KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB