Analysis
-
max time kernel
598s -
max time network
596s -
platform
windows7_x64 -
resource
win7-20240903-es -
resource tags
-
submitted
30-09-2024 21:20
General
-
Target
FR VENT No 9786857645476890897654588909876954356878.exe
-
Size
1.8MB
-
MD5
28017f2881b5a850968490a86393074e
-
SHA1
3a1680d68e4c0f39b01565fbf6592bd6430e99fe
-
SHA256
c839c2e12a11065402dddc516407b781eb50955bd2de2fc920ab296bc66b6c61
-
SHA512
6de7e71aa96f18d19263e67551b3a511c983c4ca1293a69b305b2897fe28861bc36bce4b608813319c68dc5119d56634c505e2278beb792948b392108c1cc98b
-
SSDEEP
49152:6tqXnGPZrEU5Y/+Xn1wVvma/7DP8cijtjZRM1eic9OQq:LX+L53n1lq
Malware Config
Extracted
remcos
PENSIONN
hjgfjygjfghfhfggjjgfyfgjh.con-ip.com:1666
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PL5TC7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FR VENT No 9786857645476890897654588909876954356878.exe"C:\Users\Admin\AppData\Local\Temp\FR VENT No 9786857645476890897654588909876954356878.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FR VENT No 9786857645476890897654588909876954356878.exe"C:\Users\Admin\AppData\Local\Temp\FR VENT No 9786857645476890897654588909876954356878.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230B
MD5894575d42594ec826366fc8d7c8de320
SHA183f79f8e9921f3a1cd679cc8bb712b5f8c692436
SHA25640c308bdb7d30fd10f8524564c1b9b418af48f0d3e185f48bc9c459dab3da4b3
SHA51260cef7af6085f48e613a7788e4ef68e9630f66129ffa24739d0ce6926ef000509eff6af4145dc5101960a6b1e69b28d9df66b79e58016eeaeb4c88bb45caf4e7
-
Filesize
144B
MD5f8d6311cb422f10a22c1acb61bf8efad
SHA19268141d5c1ca74b5e30261ba75130a9e103a8f0
SHA256b24830a29d7ae368cb8de15b26b53d0eefd7ea560f0624ac4ee57e2f12e7a459
SHA512e13c2f01e1c90f0b082c4f0bd2280090662104e68c12c1a1c3390a38170b5d45c099a7c4664fb4f3663b4b52511c7ba4dedd42dfa7d0dc1a9bfc944c5d6dbb38
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
1.9MB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
4KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
1.9MB
-
Filesize
96KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
96KB
-
Filesize
1.9MB