Overview

overview

10

Static

static

3

1- MARY OR...DF.exe

windows7-x64

10

1- MARY OR...DF.exe

windows10-2004-x64

10

msimg32.dll

windows7-x64

3

msimg32.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MARYORGANIZERRELEASE.zip

  • Size

    63.9MB

  • Sample

    241002-a2edbasdjc

  • MD5

    49d1512499ccb68e161f1d5589a1bf0d

  • SHA1

    6bd3ec469e97ec901217e751b4afeba5cb87ba7b

  • SHA256

    5ce0a67de6bf50c9d360841e20a4d46c4caa6e647df7d0c48c165c37e4b1d2bc

  • SHA512

    17a5c50a34b443320235d3de5133ed9896a9e7625f0ce636f607814594672112d2f72d84cf637182b26f2e0c83a0fe7995c62b2b4f23dc43d73ade1e351502d1

  • SSDEEP

    1572864:1aSHRqgkyYVr99h5U8BhyxoKgO30T21I09OP74sgu/+aOe5ZcMzCD:1aUcgkVpb5U8B5rxTE9OP3+Ve5SV

Score
10/10
remcosremotehostdiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

privmerkt.com:8922

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TA78E3

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      1- MARY ORGANIZER 2023 COMPLETE PDF.exe

    • Size

      6.1MB

    • MD5

      4864a55cff27f686023456a22371e790

    • SHA1

      6ed30c0371fe167d38411bfa6d720fcdcacc4f4c

    • SHA256

      08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2

    • SHA512

      4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb

    • SSDEEP

      98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz

    Score
    10/10
    remcosremotehostdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

    • Target

      msimg32.dll

    • Size

      2.3MB

    • MD5

      c9dfb256c42b16e619d8d4414b34f790

    • SHA1

      dd693ea98b7a94af18dffeeb15eef75e2518b8a6

    • SHA256

      1b427ec6e11bb5399045d7187afb46bac9b1eac183d68cd76571725d67fd04f0

    • SHA512

      e0393bbffa2b582178aa342c897b893b7f69d9d1d2a9191a77fd05439124baeed211f07b506bc28f33dcf51895777a2e9077f106454ee696d5f3f8c28018a0c4

    • SSDEEP

      49152:P69FikjsYvjmNN4TuF2GeBiDw0uLnlCgzzO4nkTM+M+69zAx60s50Aah6rBJsNu7:i9sYvj1YDw0inATk

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks