Overview

overview

10

Static

static

3

PO320.exe

windows7-x64

10

PO320.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    440b445dc2938b09dc1d5b76d46847b2c7f9892cf2c7b9e99c0aa121a44daa08

  • Size

    527KB

  • Sample

    240923-p7yfpsxapm

  • MD5

    91ef9ac752e5b5eced98543f79549b09

  • SHA1

    c76e32eae76c2e0e3e07951cf17d09998d8f3a28

  • SHA256

    440b445dc2938b09dc1d5b76d46847b2c7f9892cf2c7b9e99c0aa121a44daa08

  • SHA512

    a250f8576d26300733f170cb0ba564ad2c7af01c9f837bfe5092518bb1c7aea56b5367539d95d065ffda97d2e6a9fd64e8151bc53070e3d50002995bca44bf7a

  • SSDEEP

    12288:n4QYMHEUciGA53If8U91664fUb5FMOdYqUhQqMWjGcPFxv:n4QYxUcLASf8UT6Lgn6Uhqzv

Score
10/10
guloaderremcossept22discoverydownloaderpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

SEPT22

C2

66.154.112.195:4500

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-27W2HG

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      PO320.exe

    • Size

      615KB

    • MD5

      e9fccc1648186d0d9d291b3b481dce31

    • SHA1

      47039fcdd8bb71f4f1bdd6aeeecd2df1cce22adb

    • SHA256

      057ca391a027c4f82e79fcb660fa61c762fab0bc38b14e94bc387b79faaa578f

    • SHA512

      8be8bdaf238981a2817343f4147ef9a9447a02826f2f209940cb5bd5570721b8759350a91c754e9a57661a3b4ffa39fd41c17a7234b5052b9960a2d90dddcee9

    • SSDEEP

      12288:5bt4OfA5VIfIUXR66S1UVvFWOd+qUhQqUWjGKPFA:5buOfAUfIUh654vgshcy

    Score
    10/10
    guloaderremcossept22discoverydownloaderpersistencerat

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks