Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
07/11/2024, 02:50
General
-
Target
958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70.exe
-
Size
1.2MB
-
MD5
4e6fb77e41ce6e4e8ddec2a04c51b135
-
SHA1
3f3c04d941792d7598bc6e1fb1814c44ca3d1cf4
-
SHA256
958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70
-
SHA512
0835f76379fc423c5e194bc8e852492bd68bf7b885f14e07d1dd1878d16d9a1a91153e47d484bc58cecca106547444b87587dfa8d6897acfa10f0efe5b08d619
-
SSDEEP
24576:tthEVaPqLopaxpymFCZqtRGGAsL4+ktZuStEJz992or8rekadSfU84w:VEVUcI0pyrwtRGGA6mgStLo8uEf
Malware Config
Extracted
remcos
RemoteHost
192.3.101.137:8780
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-EFS67M
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70.exe"C:\Users\Admin\AppData\Local\Temp\958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\rhombical\selectedly.exe"C:\Users\Admin\AppData\Local\Temp\958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5cf3121867a306aa323b5b0526c170869
SHA1b7522326d7c295149dea439ec7f667d9941d2bc7
SHA256d50d1fa47567be556f12d74155e38bce1dfac886f87291a69bfbca320edd7dff
SHA512a407cc843d5859606c0f3c6b824d63e8a172234acfd18a45e5a2220d352886f0d03d203a0bb647e1f1d0061fa82f72cef0830b74f605be8cda68cac1ad986840
-
Filesize
1.2MB
MD54e6fb77e41ce6e4e8ddec2a04c51b135
SHA13f3c04d941792d7598bc6e1fb1814c44ca3d1cf4
SHA256958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70
SHA5120835f76379fc423c5e194bc8e852492bd68bf7b885f14e07d1dd1878d16d9a1a91153e47d484bc58cecca106547444b87587dfa8d6897acfa10f0efe5b08d619
-
Filesize
776KB
-
Filesize
4.0MB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
776KB
-
Filesize
4.0MB