Analysis
-
max time kernel
599s -
max time network
600s -
platform
windows7_x64 -
resource
win7-20240708-es -
resource tags
-
submitted
09-09-2024 15:59
General
-
Target
out_sig.exe
-
Size
1.5MB
-
MD5
a2f672a48f20f69a981c24c4ac9f7a34
-
SHA1
2afc0f87c56665a55ca318c795e7035c1a525c9e
-
SHA256
4df31cab3c799c3713a6b86b1f5e114da9d67dee6bb5a35e2b125367417c8246
-
SHA512
ae585705cdd8acdb09c46e79d480c2a0e046b03836351991d95d861257376aed0dfa36705d3f611ac949094c729c01097cfb11c458fb6f16f7f79437aec349bf
-
SSDEEP
49152:Bf7I4o2DzfAgaLv6NNPB5RcAuOj0OSESM690XY/+Xn1wexsXl0q:U90X3n1hxsVv
Malware Config
Extracted
remcos
NAUVALER
confrewdsfgfs.con-ip.com:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-882UHO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\out_sig.exe"C:\Users\Admin\AppData\Local\Temp\out_sig.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\out_sig.exe"C:\Users\Admin\AppData\Local\Temp\out_sig.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230B
MD547127882c8a68f83f7d06fd4bcd2a7e2
SHA1f1443cc56990db50ef6bb76e47aa8f06b7061229
SHA2566d3ec5af5a01758eb2dcd1d62795f15395cb0114b5174bc795b3f4421a06716e
SHA512eb068b6fbf160d163b6440a92f89ab48c1fb6a2cc192bc176a21efcc2ec0cba691f9efc00e242a99d873e116c8e10865a5b0e09a58b39babca238de51dd93f04
-
Filesize
144B
MD5f713bf7ccc58d1f26e873bc8e1c9e62f
SHA1901de045d0a2e1d789a2c73920d080ed7ef3331e
SHA2563460e9722e1d917c50629339648e4d09b2b0c856f3be416c66b758ab300bd893
SHA512810ada5141c87a2bec571e515229ca3ce9aa70aa60b8fe3bf02daf33624c4e4697893c16fb204b53a08fe1d086ce6ebb877a1c725dceac565b582737ca6e8293
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
4KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
1.6MB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
100KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
100KB