General

  • Target

    2620-40-0x00000000004D0000-0x0000000001532000-memory.dmp

  • Size

    16.4MB

  • Sample

    240925-r11zcstgrg

  • MD5

    edf8b9163ef84e592c3b023b39579571

  • SHA1

    f0c7a59336722da05e15f88d12c622a1d31b74c8

  • SHA256

    fc25c31d668ccd528ec3683b22a34668a6192c39fcdfaf6b7c0a7bc845706fa9

  • SHA512

    7e62f2fa31dfd1bd1d565a049d8091744a6e170fa3d975004c8fa75a2defb98043b8a825d701ea0341ac499046a8a8de07adbf6c4254e0ef3439a7ce8dc23342

  • SSDEEP

    12288:eLMyp8MjHLWsQYibC4hoexeqTHpSLs/ZgGT4:IasQYibneqTH5Z

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

Rem_doc2

C2

107.173.4.16:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-DSGECX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      2620-40-0x00000000004D0000-0x0000000001532000-memory.dmp

    • Size

      16.4MB

    • MD5

      edf8b9163ef84e592c3b023b39579571

    • SHA1

      f0c7a59336722da05e15f88d12c622a1d31b74c8

    • SHA256

      fc25c31d668ccd528ec3683b22a34668a6192c39fcdfaf6b7c0a7bc845706fa9

    • SHA512

      7e62f2fa31dfd1bd1d565a049d8091744a6e170fa3d975004c8fa75a2defb98043b8a825d701ea0341ac499046a8a8de07adbf6c4254e0ef3439a7ce8dc23342

    • SSDEEP

      12288:eLMyp8MjHLWsQYibC4hoexeqTHpSLs/ZgGT4:IasQYibneqTH5Z

    Score
    1/10

MITRE ATT&CK Matrix

Tasks