Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 02:24
General
-
Target
4fc786009ad36ded81dfbd863802b06436b718112c35a505d447f6e0d31cbf8d.exe
-
Size
714KB
-
MD5
a03dcb82d6ecaab34cc6ae971a806c06
-
SHA1
3bf367387ad278b154bd2af42e7bedf0f8676f6c
-
SHA256
4fc786009ad36ded81dfbd863802b06436b718112c35a505d447f6e0d31cbf8d
-
SHA512
a11a2c0e59cd229d6d8de8edb4322ca434e5931ef94bb1cf4c5435e891125ca8c0518a675277c36936ff47e71eab7954ce17aaa36abb0109cbf84087e9652352
-
SSDEEP
12288:E3cAEjowqtlkCSN+RgfcWNQDw9HSAcQ4A5uKrQrxco0+tNADhZebeEkOP:E3cAEjowDCC+R7ab9HSzJWoV07fDW
Malware Config
Extracted
remcos
LoneWolf
odumegwu.duckdns.org:51525
odumeje1.duckdns.org:51525
odumeje.duckdns.org:51525
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-3DX9QW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fc786009ad36ded81dfbd863802b06436b718112c35a505d447f6e0d31cbf8d.exe"C:\Users\Admin\AppData\Local\Temp\4fc786009ad36ded81dfbd863802b06436b718112c35a505d447f6e0d31cbf8d.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fc786009ad36ded81dfbd863802b06436b718112c35a505d447f6e0d31cbf8d.exe"C:\Users\Admin\AppData\Local\Temp\4fc786009ad36ded81dfbd863802b06436b718112c35a505d447f6e0d31cbf8d.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5504ad3b74590fcbf96940f0a97ea23ec
SHA19ef9c893403a9dec1d1fa60d47fe78a2d7cf1f44
SHA256b11977e3426e6989f0677291c1052abc6cf641f7d740908a0d239005281a0270
SHA51297a4be8361c0e6fae01fd3dcc729df870f9378baea84b683fcb79dfeadfda5b1beebe0c8d0cc951510e7a17eb8dcc203b30ca144298cdd572686963c33e19bf8
-
Filesize
12KB
MD512b140583e3273ee1f65016becea58c4
SHA192df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA256014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
SHA51249ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
-
Filesize
26B
MD551363b8d2e5583ff2bfea0ad020f8ac0
SHA1bf73704dedd0ed2a6c383f9370d7ce27e19d79ed
SHA256939fb56ca6afb8ec7f034eb2c92880425c966e10a113c87a979130de27701210
SHA512b0217d6ed0dcf3f677cc0e3a890c837968ec33ea5e2c4ba3f324305a8cb5a07d898b9742d7c37d4c3590e0306348af8e07f24fb5b6f68193a5bcd390b7ddd3b5
-
Filesize
34B
MD544faec7c0702b7ef4cda5820a608da0a
SHA110313d20436f6968228a07ad4dfad29f37e6532d
SHA256c9eb8d8cea8dd215bb20f4674c6b4b3ea865cc9390eb982c501af89142dfd95d
SHA512dd2bf84c8609abd2f9acc8f45ead13f65f2f804cc2951774b857c0a86616d2a4656a88af4d8277e71bb3bf34afd065ed4dd62577f215f8e4b2f6683967db3a39
-
Filesize
54B
MD58e69760955a717be873f8253ebc6905b
SHA1c813b0cc54451465777460ef2f46bc98c273c739
SHA2563159fb26988fd82c5a652bdf09e65bb021011a4f8953f009c0a7d893149a9c8e
SHA51216de94f841400aeffd2b67ca45e807da10023229f667f746b8fc7b127c347d843ff51b822191e656a94b63d8c8187c928d40113914d34570136c878b64279600
-
Filesize
66B
MD53a055708070979e7bf5088d9471320ba
SHA1cb4e803ae05765ee43787cbd3abb91166bbf8fd7
SHA256cc1c32ae1abcb46fd4871832a8b7a51a440905d97709c53e66d16a0cd33276ee
SHA5123f3b5c9c1fdca9e76fda76ff601d11320b4866ee0b0358b014699e33be79252cb94390fb589fa5099b68d00491a207f3fe6223b955a5a4be6f1df1b389fd613e
-
Filesize
69B
MD53f9d86b820955195e9467112480c175c
SHA1c9b53af6ff79125000b5aee2afb33ce6575d4d31
SHA256ab4b36271e68b6e5b546158733c5450e775242021442a40bec4e42838eecca53
SHA512ed78bd4b7b9b953bf73b1156872864b68ba1b46b3c2e5d21c56766217ec8b70e6421796a9d31716a94d62d81cf7a2c9f83735ea7c229881d4845c70364b77a17
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
43B
MD511598c9bea98b902fd23f62d92e2c755
SHA15abf26b3891bde2c11143deac679d44d5af7dde4
SHA256e57e26e68b9ee25d136d2b440e28ffc09be1233efac52ec2f050c098a7e8090c
SHA512aa6045bade9bee63b80e2822d1e17ed4186202c8ba840af93f4d14dad4a2d32790e1ffd7448b4cbc8b92891967174cf70a54d2aa5957f3b266da7bb61d8f6b7c
-
Filesize
47B
MD53463a4cc4cc8584279b312ee3ae746dc
SHA1512bb30dc772b97916374c4ba7ac0263dab1ffa5
SHA2564d9933ad3cb07723bac43a5c519fb12e5950334cf688b284acdfa4d8931d5620
SHA512239e174c3cea06f716dfc802fd32bddfa78d51f07d91f1cfc28ab0bf125d22bd18c6f05af672b0b8edbb6a618f4e6492fe1b41150c34cc3196070961c34c010c
-
Filesize
22B
MD51a976b081f77c04dad951286222ed3da
SHA11fd2c47eab6b8b5ee42fee2f8238bd065881d99d
SHA256d7c42493656ae25d5a3ff0b7fa739e43557d2c54a82833c8782ddbe8d364816d
SHA512e087d4f397761e3525241f2610f8be1bd46533905fc0bf39435127e1341c1f4c21fc1d2f1b213d78b0505d8bafbc4f797b85537601a0f186850457d3d2847a23
-
Filesize
23B
MD5cc425c0e67a76a3ef42ffd875ac98788
SHA181867852fcd85548b1dc0d6a4acd4135055ff869
SHA2562787c54979c964e4cc50064d4d89581a327a02067a8efb1be41764f428e9b5ee
SHA512da263e2abfe2b2f1809edd4f67e76051141c16ddc1fd8c19f24e494c1e2bde6cdc099799bedac0cdcc2b5e06a1d6ea2d582023d4dbfb0cf03a690f7daa09d8a6
-
Filesize
36B
MD50818b53b46f3916f04da816e685cbbd8
SHA1b1fb987d6e1efb77a0c3e3f71e9346b06d864813
SHA2565f96090de43d795f232b813964efc7635163ceeef9381326a17b89b1dd5d0b8e
SHA512c525cccab3a85b911ed6da4331e670cc3bfe4fd20314256715c1276f6b726fe327e69dcd2107680b6176732befc8f672aa7f6acc68290665ad4cab6eb800dcda
-
Filesize
49B
MD5862d905f91bbda36cef0ce97d96f946e
SHA1b60689e1c049e070a6f8caaf9618ffc943756608
SHA2562a2eb56ef14a8d312a968f8c32dc5787efa125085f17219245aed478f1b45a7d
SHA51232969a23eb49e066a3d6efbff91d2a376929e1af6c1f84c4f65653d16f17401ce1531afc362061b977be1403c3ec9950f2d7763ed1cf387816fb184f0ea18c2f
-
Filesize
14B
MD54916cd6b7dda05c7a23b1d31d796ed7b
SHA1a999776c87fb3bc6fc6390469c79ec302ee2410f
SHA256fbd1ae27c78de7d1be52844bfb664657c23dc7a39dc32126f422e26ef472b954
SHA512db2e17ed849245ab83db878e80b743fd1967f8609793be2736e300d683f9484e61c83fdab089fdf39aca4d196513d7afe65ec7d37964a162852a3f372e39d051
-
Filesize
10B
MD59a53fc1d7126c5e7c81bb5c15b15537b
SHA1e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA256a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
SHA512b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
-
Filesize
19B
MD543157868a196cf407824a5411f44f7e2
SHA17752306ef99ff3506a6ff41cb71d0c347b932565
SHA25612a5b941c522748da012db793d839e52457ef62d7964de9001a30469f69e05d1
SHA512322383a4d970f07ba4e00417d42054ea58347b5d4d068b85669d9512380c772f80788358d579a0419df634855711877478bc67bd1e7d2f8f6d30c63f63368852
-
Filesize
25B
MD5d3144a48344fb7e92143afd22844d684
SHA15125040cc4ae70e7d78bc767cba0bca8238e21ac
SHA256094fe155451e834d551457304fa995d544fde9079944bb275f6b4bc158e25e2d
SHA51298b0a5f95b730738f02e04c7ed2906d0a7bdbbfab7ffe34c2317f36ceff0a9fae3068f0a4a17d8829c1e6355984e19c50c399e4b7ae2c81a568adf826fcbcb37
-
Filesize
32B
MD5749841d5d4f33aa61da2072ca8c75d85
SHA1ed779369af6004bb662353a1a1688de21c9d5964
SHA25605ec837bf0f57ead1b3fae5bec24f103831be6946eda1fe4cec3700ae019b117
SHA51207884f39b2b1646dbad182d39167df36cb86fd3751b5c125b84ab3b3594dd0f6884d73f7f65d099e2874a0a73f8a76d7610b3ab30e174945a70073176e07b886
-
Filesize
36B
MD53d4b43e24f8a5cb80bba86e69735e146
SHA1caaa79191da01e6cdd282f084dd7299c54a57dfe
SHA25654f4b8891dda2b1f31a6b798b8ef5e253f79173727341309c86f50191584a3eb
SHA5126d34fba9a130aaff8dba31f64f7f0c4168134092428661adf9906826e39d497754927a479dcfe0809101b6da0a1d7c08cbb53ccc74c371edbf01c054c7bce4a2
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
8B
MD5c3cb69218b85c3260387fb582cb518dd
SHA1961c892ded09a4cbb5392097bb845ccba65902ad
SHA2561c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
SHA5122402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
-
Filesize
37B
MD5e8c18675512ae7a157ecefcd0ccb8a39
SHA11be3573b104dcbfea327ca8bdcd3117e9f2aa5c8
SHA256e2e68104a9c94e67d09ca759e6198f071a83dbc480114349bc58d3d4bb0dd81b
SHA512a137143beb6e0b7a25e4a2511ac310ec7649351d35fae51ae23b3d4492a5f4a16cf388f4fe9ff88d5cc3d4c46abbd96a04131c2fb6fb375c4c7f0888a7a1b8a7
-
Filesize
54B
MD5260c98d7f8711581d74b765418ab0c62
SHA1c1576919e479c83a60f20d2942e5accca52459dd
SHA2564f1799843d94d8e3aac84596a7332f01e5dd4dedde6d140f3f6c1281959a1f1c
SHA512a1c96695c6ddedf4faa10c28dddd13a0f6017370704b70a65518e0db8a9136e5cf94acd628f5763844a77b79dff032d4b2d597d94354fd96b567df73af7ddc5d
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
4KB