Overview

overview

10

Static

static

1

c6ecc9e2a1...18.exe

windows7-x64

10

c6ecc9e2a1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c6ecc9e2a17ad00d09b3ead6c1f333f9_JaffaCakes118

  • Size

    575KB

  • Sample

    240828-qjjhbazble

  • MD5

    c6ecc9e2a17ad00d09b3ead6c1f333f9

  • SHA1

    965d636562e120fbc204b1dc2159f577f4516d73

  • SHA256

    fa18c4f6cf710cc1cb846eff0c661373b9f73c3343feb0f936ee6b47014ea944

  • SHA512

    2567ded3b3b8cdbcd8ba913742694fbad9d08896541fcf63b1da50bd9579d5f0738be9a0a7bca924f5abab9fa91ca102c2a592ddaf61018e256a5a2dbc12dcb0

  • SSDEEP

    12288:W2fSRHrD3yXWWcKk2H+XMM/eQYIuynBHkvbtihJMIHoB:W2fSRHrD3yGWcKk2LQYIFHkv+k

Score
10/10
remcosvictim-newdiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Version

2.0.4 Pro

Botnet

Victim-new

C2

www.suchfamily.eu:5563

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    winsoft.exe

  • copy_folder

    System32

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    BKKDNKDNODNDKNDIODNKDNK-6KWIAE

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    windonw

  • take_screenshot_option

    true

  • take_screenshot_time

    5

  • take_screenshot_title

    Wire Transfer;Payment Slips;Bank Login;Bitcoins;Shares

Targets

    • Target

      c6ecc9e2a17ad00d09b3ead6c1f333f9_JaffaCakes118

    • Size

      575KB

    • MD5

      c6ecc9e2a17ad00d09b3ead6c1f333f9

    • SHA1

      965d636562e120fbc204b1dc2159f577f4516d73

    • SHA256

      fa18c4f6cf710cc1cb846eff0c661373b9f73c3343feb0f936ee6b47014ea944

    • SHA512

      2567ded3b3b8cdbcd8ba913742694fbad9d08896541fcf63b1da50bd9579d5f0738be9a0a7bca924f5abab9fa91ca102c2a592ddaf61018e256a5a2dbc12dcb0

    • SSDEEP

      12288:W2fSRHrD3yXWWcKk2H+XMM/eQYIuynBHkvbtihJMIHoB:W2fSRHrD3yGWcKk2LQYIFHkv+k

    Score
    10/10
    remcosvictim-newdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks