Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-10-2024 14:36
General
-
Target
OFICIO Nº 0495949594 ACTUACIÓN PROCESAL RAD 2024-00531-00.exe
-
Size
331KB
-
MD5
11b94847a9272d020e13c6485515dee1
-
SHA1
34c60c1638dfa9b2f9e07e6dd70a2014547a4ade
-
SHA256
c8691ad7b172874c5bfbd1fb9006613973e551771367ff7d538b29ca2f7bf6c3
-
SHA512
a2de8898cbd1db9273f1470728f7c1832e5b681a1d72ec8bfb91654cb99c2e4d8b7e92c157b755f3dc7b5a5437be3717bb9726575e01af052cc46b6da0cccb5d
-
SSDEEP
6144:n/mbJQBuSXHz2bKnb0lQUtmEZrdcqLKRDgdjAmiYFp5jP1k0V:eNt8irremKxgdZiYxjP1jV
Malware Config
Extracted
remcos
ZEPTA
platino89.con-ip.com:1836
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
XCVXCGFGFGFDG-TEGKLX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\OFICIO Nº 0495949594 ACTUACIÓN PROCESAL RAD 2024-00531-00.exe"C:\Users\Admin\AppData\Local\Temp\OFICIO Nº 0495949594 ACTUACIÓN PROCESAL RAD 2024-00531-00.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD567b0a9e1be1acf5cb88b2f787fb65cc7
SHA145e64ee6d5350cc50c6d42886fed43bde0c62d78
SHA256b60079e883661c91aed86d3c7fab3bc13cd27d0bf66a6f1d3506ba4b583ad107
SHA512b6bb5ebe3a9b1d8f12d9b921fd111cb1d6fab83a72cc47c34b652b6079275486b83d4a5c0ba0692c43773a38cf5bd554eed2aebe48b0d0ef101c93578ed17b90
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
4KB
-
Filesize
352KB
-
Filesize
7.7MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
608KB
-
Filesize
304KB
-
Filesize
5.6MB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB