Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-11-2024 15:00
General
-
Target
SENTENCIA DE TUTELA; No.456 RADICADO00746-2024..exe
-
Size
3.3MB
-
MD5
123f8bdd76db349ac3efb3d39716932a
-
SHA1
18f37bfa484dff0b702924b280121e74839f21af
-
SHA256
01c2b04b600f71e8ddd2c420c0427e82737f241f9c31d0f3ce5c8405ca1e7d67
-
SHA512
24d7623644076b0ad252f7515d9530a73999ed97009995fb9deef4091a89d2c5b762cb7ada25f52493397258a19eeba00741fbfba88bdf78ac168140adf77e74
-
SSDEEP
49152:DZHWFTgHsE5n8WjWNCuFd8/1e0EFkFwNUwABWJTXMvI1hcNBPE9B:D9WFTQsEOQEFd8NeomAaT8vJX
Malware Config
Extracted
remcos
BOTELLA
noviembre06.casacam.net:2708
noviembre07.ydns.eu:2708
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-VPFO74
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Drops startup file 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\SENTENCIA DE TUTELA; No.456 RADICADO00746-2024..exe"C:\Users\Admin\AppData\Local\Temp\SENTENCIA DE TUTELA; No.456 RADICADO00746-2024..exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD55d653eeef2620f2dc8ca823459275145
SHA1e2ba071e28be681cba38c1773b499e770f46ea90
SHA256775f70ca1451780f4aecb0f933ed87dd5cb0c5ef236dc18fa92efac6f0d1de7c
SHA5128701c3285772a4618fb71fdedcce9230c36306d47ce71f70c90f5191f94d7af89d3353819df8c196943232fbc02aeb44368bfc09866b431d427377efae3aff61
-
Filesize
1.1MB
-
Filesize
336KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
7.7MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
7.7MB
-
Filesize
608KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
508KB
-
Filesize
508KB