Analysis
-
max time kernel
179s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/10/2024, 14:00
General
-
Target
Nro. de comprobante 0000062221 TRANSAFERENCIA OCTUBRE 21 DE 2024.exe
-
Size
2.8MB
-
MD5
b4e6c9db13a14697cb9eb9ef5f2c27c2
-
SHA1
1015229197790844ed149e1c3066647016299163
-
SHA256
68c75ba3fb131fa8d015169c3dd717f1b79cf2688fe87c87695ba9e04df87695
-
SHA512
bb9920b1fa19a6bdb616a70526e3eb5090b4225394ac2c3858237d2746b304e15273dee5b10166417924acc38d65ab009243c8bab47aeacff3024d71cc919b0a
-
SSDEEP
49152:1TJvoJ67eQD9rSlwthuDZzjz4YVw/ehjzEWZ80sgQOvfRmEmNixi43:1TJvn1udzjz4YPhXEWGDAiq
Malware Config
Extracted
remcos
BUROCRACIA
solumintir.duckdns.org:1994
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-NCJKEB
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nro. de comprobante 0000062221 TRANSAFERENCIA OCTUBRE 21 DE 2024.exe"C:\Users\Admin\AppData\Local\Temp\Nro. de comprobante 0000062221 TRANSAFERENCIA OCTUBRE 21 DE 2024.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nro. de comprobante 0000062221 TRANSAFERENCIA OCTUBRE 21 DE 2024.exe"C:\Users\Admin\AppData\Local\Temp\Nro. de comprobante 0000062221 TRANSAFERENCIA OCTUBRE 21 DE 2024.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5f2289e5cbea3e8ba3983375bbb379372
SHA1b94ab6a5ad1c2cda3d71fdbf7f9fb2d21e7fcf74
SHA256464a5c244413f2ae2bf318a66522042ee038adb90cc3caa5d485cd56643e1bcd
SHA512b2a88bd9e98700519360a7c4116f80a3faaccadb805e70592fc868e75b651d6b6191b35b497e39ce7fd70ce0ab21aa970d80af04ff122afe7a4865d4b09308d4
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
2.9MB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
96KB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
96KB
-
Filesize
2.9MB