Analysis
-
max time kernel
178s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-10-2024 14:23
General
-
Target
PROCESO EXITOSO DE PAGO REALIZADO - TRANSACCIÓN No 143201-1709694808-52264.exe
-
Size
4.5MB
-
MD5
6232a988e3d27dac3a691f1f439d05bc
-
SHA1
2c005a4651a1faee5401a5e1e566245e0fdb8d87
-
SHA256
0c4620df9290817f179192d7e02feeeddf9c05c4ee51fb0c86afb247ffffb10d
-
SHA512
083be04ee2378f6aca4c3f528b4ff53d27964f50dec2c3df0f1f3f2108e1b5b610c80bb5fed080291c4083b1e794f2ef7ffd7e1ed5b0d6b4309e509bdf00b09b
-
SSDEEP
49152:jyVdmxB5GSL4m35GyJZYMrbcDifMb2+X5KoQWZxaMxrVYTEHv0SkW4lLFQoMExc0:jybbOGyJZYMrb7fMb2c8oJZh4BWCMEXX
Malware Config
Extracted
remcos
Voltarger
dfgdfghghfhfh.con-ip.com:1665
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-I3REIW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROCESO EXITOSO DE PAGO REALIZADO - TRANSACCIÓN No 143201-1709694808-52264.exe"C:\Users\Admin\AppData\Local\Temp\PROCESO EXITOSO DE PAGO REALIZADO - TRANSACCIÓN No 143201-1709694808-52264.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PROCESO EXITOSO DE PAGO REALIZADO - TRANSACCIÓN No 143201-1709694808-52264.exe"C:\Users\Admin\AppData\Local\Temp\PROCESO EXITOSO DE PAGO REALIZADO - TRANSACCIÓN No 143201-1709694808-52264.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD55661d358880596a8c5b03023d6458780
SHA182033d9d73c10eedbbb4263b3e9fbc906cb26393
SHA2568461de973fa69d8eaf42a361b6dc0c08b413a0d379ffd6beeb53a76607bd8f26
SHA5128ec6beff1cb2eeb72a0d854486aade1b63d52b988b6675385dac03555b3811c7096df5b9caa7955198a1ec86e7e3dd549c92917b6c3ff7faf4ed68b0c6f773a7
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
4.8MB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
96KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
96KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB