Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
23/08/2024, 09:55
General
-
Target
74e9edd0440b69ca95a255dd2a4341c06d3573bd076ade78927e8614936ac783.exe
-
Size
373KB
-
MD5
55190d2066995b803c24f559a0640116
-
SHA1
72569d6c8ebc1714f4eb590b3ddf6ffc83b8807d
-
SHA256
74e9edd0440b69ca95a255dd2a4341c06d3573bd076ade78927e8614936ac783
-
SHA512
2e9386e5f24982759afb994f2b1e8afd201891befeb19647c5027e1f3859db9afe0b3eff780840364320d56801c4baa0a12e626e2e9ee1cfd8019016999a1658
-
SSDEEP
6144:5dg5n5DJJL7XJAnY7yo0nqsJ445mgy+sk8VAX8dN4pR:innJHX+nO8hJB5mKD8Ze
Malware Config
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e9edd0440b69ca95a255dd2a4341c06d3573bd076ade78927e8614936ac783.exe"C:\Users\Admin\AppData\Local\Temp\74e9edd0440b69ca95a255dd2a4341c06d3573bd076ade78927e8614936ac783.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
400KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
32KB