Overview

overview

10

Static

static

10

33ab798aff...ed.exe

windows7-x64

10

33ab798aff...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    33ab798aff2e9e3e550354ed16de0430888149747ca068cf793486b18f566846_unpacked

  • Size

    96KB

  • Sample

    240916-197myasgpa

  • MD5

    c8dafe143fe1d81ae6a3c0cd4724b272

  • SHA1

    aff9845e362bc990649ea5ee2e8893f7b3c0d507

  • SHA256

    33ab798aff2e9e3e550354ed16de0430888149747ca068cf793486b18f566846

  • SHA512

    e3f5d2abb7740cc17629f212cbfa86132a0844dbd0933a7549bac7887dd4021d5ae68c0edab26a41d32172d958e796c8a10a31058c8eb5f63585c78a56381a7e

  • SSDEEP

    1536:L7br3qpq4YvkzsdDL6e0Twjc5sh2RP2g+gy4s3VaCZKpA5KqBjk6xvWHM/6NFSTx:LPrapq4YMeDLJ0Mush2RPVNLs33KpgjV

Score
10/10
remcoshost-xmencredential_accessdiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

remcos

Version

1.7.4 Pro

Botnet

Host-Xmen

C2

5.133.15.4:1977

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    adobe.exe

  • copy_folder

    Adobe

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    X-Men-Z10Y4G

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %Temp%

  • screenshot_time

    3

  • startup_value

    Adobe

  • take_screenshot_option

    true

  • take_screenshot_time

    5

  • take_screenshot_title

    outlook;bank;payment;wire;transfer;password;recover;

Targets

    • Target

      33ab798aff2e9e3e550354ed16de0430888149747ca068cf793486b18f566846_unpacked

    • Size

      96KB

    • MD5

      c8dafe143fe1d81ae6a3c0cd4724b272

    • SHA1

      aff9845e362bc990649ea5ee2e8893f7b3c0d507

    • SHA256

      33ab798aff2e9e3e550354ed16de0430888149747ca068cf793486b18f566846

    • SHA512

      e3f5d2abb7740cc17629f212cbfa86132a0844dbd0933a7549bac7887dd4021d5ae68c0edab26a41d32172d958e796c8a10a31058c8eb5f63585c78a56381a7e

    • SSDEEP

      1536:L7br3qpq4YvkzsdDL6e0Twjc5sh2RP2g+gy4s3VaCZKpA5KqBjk6xvWHM/6NFSTx:LPrapq4YMeDLJ0Mush2RPVNLs33KpgjV

    Score
    10/10
    remcoshost-xmencredential_accessdiscoverypersistenceratspywarestealer

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks