Overview

overview

10

Static

static

3

e38bdd8374...df.exe

windows7-x64

7

e38bdd8374...df.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf

  • Size

    885KB

  • Sample

    241105-qt1vca1mhs

  • MD5

    5009d8c72623d30ce09149187c66d37c

  • SHA1

    5c6035f099f16ff4753198e5f631ba410e98227f

  • SHA256

    e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf

  • SHA512

    5908f38589b4097fd96f35129bbfa344a7940193ef0df6dab4e514106e7054c8ea9b3e97f9ebb7ff36fdbbd7c724cd1500e37f6c1ea6013f51842d39a642b5c1

  • SSDEEP

    12288:i3nIF6bq58AFe0TenvBdHdpUXjwxipfpQGYAGau5yxX9O9R:i3IFsmez5pdpUXjUiNuGYpawA9uR

Score
10/10
guloaderremcosremotehostdiscoverydownloaderrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

162.251.122.106:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-BHLA3T

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf

    • Size

      885KB

    • MD5

      5009d8c72623d30ce09149187c66d37c

    • SHA1

      5c6035f099f16ff4753198e5f631ba410e98227f

    • SHA256

      e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf

    • SHA512

      5908f38589b4097fd96f35129bbfa344a7940193ef0df6dab4e514106e7054c8ea9b3e97f9ebb7ff36fdbbd7c724cd1500e37f6c1ea6013f51842d39a642b5c1

    • SSDEEP

      12288:i3nIF6bq58AFe0TenvBdHdpUXjwxipfpQGYAGau5yxX9O9R:i3IFsmez5pdpUXjUiNuGYpawA9uR

    Score
    10/10
    discoveryguloaderremcosremotehostdownloaderrat

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      6e55a6e7c3fdbd244042eb15cb1ec739

    • SHA1

      070ea80e2192abc42f358d47b276990b5fa285a9

    • SHA256

      acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

    • SHA512

      2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

    • SSDEEP

      192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks