Overview

overview

10

Static

static

3

ab4df763c5...ba.exe

windows7-x64

10

ab4df763c5...ba.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe

  • Size

    782KB

  • Sample

    240831-b7bp2syhmm

  • MD5

    4198250ab9b371a88707e6f5885ad17b

  • SHA1

    19204d4586ff59e83ccc974ddf5471690e47eaf1

  • SHA256

    ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba

  • SHA512

    737e445ea137224269e37e61b776f76db7704333c7f73c4bf7769521f3ca8563ebb30983111ae67eee4c9871b3a688cc9d7a3cfab370f59ebb84b18156408fb8

  • SSDEEP

    12288:4GQBy+G5GCSd1eesm6abgGMwNUVPvHooksN:n5+Eq1yHwkvBN

Score
10/10
guloaderremcosbenchaodiscoverydownloaderrat

Malware Config

Extracted

Family

remcos

Botnet

benchao

C2

tochisglobal.ddns.net:6426

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-9R4HLX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba.exe

    • Size

      782KB

    • MD5

      4198250ab9b371a88707e6f5885ad17b

    • SHA1

      19204d4586ff59e83ccc974ddf5471690e47eaf1

    • SHA256

      ab4df763c5581670d4163462003abad97e8a309fa976fb0d840f44bdd17db7ba

    • SHA512

      737e445ea137224269e37e61b776f76db7704333c7f73c4bf7769521f3ca8563ebb30983111ae67eee4c9871b3a688cc9d7a3cfab370f59ebb84b18156408fb8

    • SSDEEP

      12288:4GQBy+G5GCSd1eesm6abgGMwNUVPvHooksN:n5+Eq1yHwkvBN

    Score
    10/10
    guloaderremcosbenchaodiscoverydownloaderrat

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      f1e9eed02db3a822a7ddef0c724e5f1f

    • SHA1

      65864992f5b6c79c5efbefb5b1354648a8a86709

    • SHA256

      6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df

    • SHA512

      c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c

    • SSDEEP

      48:S46+/fTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mjsofjLl:zRuPbOBtWZBV8jAWiAJCdv2Cmj/L

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      17ed1c86bd67e78ade4712be48a7d2bd

    • SHA1

      1cc9fe86d6d6030b4dae45ecddce5907991c01a0

    • SHA256

      bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

    • SHA512

      0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

    • SSDEEP

      192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks