Analysis
-
max time kernel
179s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/10/2024, 19:23
General
-
Target
Portaflio Prioritario - Informe de Robo 21 de Octubre/Doc 030435993940034 - Informe de Robo 21 de Octubre.exe
-
Size
2.8MB
-
MD5
d8c548207ef7aaaeae2d83dc53ea84fc
-
SHA1
1b785c08d48a8ad9c70fc30411759ab730d77512
-
SHA256
13754433d3ede403430e4eafdc1a45567639716e9ee8763bf3a6b391ae07ada7
-
SHA512
7d934aa40716329e9cc09574cf56913819b6b3d316dde4cae536856378722940b033b61973d33d5bd23da9ff337f70ca5a704ebea56fe114aec9bde7fb6a1ed7
-
SSDEEP
49152:7nP6JoJ67eQD9rSl5thuDZzjz4YVwNehjzEWZ84+dFTN1SmxANwJMigXAJ:bqnQudzjz4Y1hXEWG4QMrAJ
Malware Config
Extracted
remcos
ZONIDO
intelcom.ydns.eu:1831
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
nsdnnfndjfd-M797LK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Portaflio Prioritario - Informe de Robo 21 de Octubre\Doc 030435993940034 - Informe de Robo 21 de Octubre.exe"C:\Users\Admin\AppData\Local\Temp\Portaflio Prioritario - Informe de Robo 21 de Octubre\Doc 030435993940034 - Informe de Robo 21 de Octubre.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Portaflio Prioritario - Informe de Robo 21 de Octubre\Doc 030435993940034 - Informe de Robo 21 de Octubre.exe"C:\Users\Admin\AppData\Local\Temp\Portaflio Prioritario - Informe de Robo 21 de Octubre\Doc 030435993940034 - Informe de Robo 21 de Octubre.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD56a48bb5dab65af19b43595ca9b79502b
SHA1b1a735ae48b7c70d837e92c49512039bc1cdb11a
SHA2568880ec6a761991ebf64a988a59301c76c6506c0b361eeed5933e58132f35d1b4
SHA5128dfe7956a9cae7004d159fcce8eebd7c60bb3c3ee089491f134d911fcbd0e5427ba012060f0fc0f9a9c06afc2bd08b94640b864e374083c01388bc42eb333596
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
2.9MB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
2.9MB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB