Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
22-11-2024 13:05
General
-
Target
800399031-18.11.2024.pdf.exe
-
Size
1.0MB
-
MD5
54a5436bb5bf3977e98eda5ce6f8e8d2
-
SHA1
5aed6273fe965d5e0c41b0e934aa92099327e4da
-
SHA256
efbc15ccbe9e7b1f1648d94c5e38e3149bff5d33ad93c0a56e68db648050509a
-
SHA512
0948ad9fb15f733c2a7df75f72da0dbd9a96e27b8228b11346c20fdcd0fc2888c634bc2ba5cb3ffd82c79190745ac7eba8f278d7036d79fa2cab6de8fc1f6ab9
-
SSDEEP
12288:FWCYKo7G7uh5W7R1c7MWLy5FbvG8bDzIMM3bGpsgUVEgcb8YaMCnHMybyac7nSZ7:FW+o7Co5Ww7Muyjbu4VlUVEtaMJZ7SZ
Malware Config
Extracted
remcos
Host
oyo.work.gd:3142
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
vlc
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
pdf
-
mouse_option
false
-
mutex
jkm-I9KENP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
ios
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\800399031-18.11.2024.pdf.exe"C:\Users\Admin\AppData\Local\Temp\800399031-18.11.2024.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\800399031-18.11.2024.pdf.exe"C:\Users\Admin\AppData\Local\Temp\800399031-18.11.2024.pdf.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\800399031-18.11.2024.pdf.exe"C:\Users\Admin\AppData\Local\Temp\800399031-18.11.2024.pdf.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5df7e4b0f4b7ed06d3bd0d504eb6cb204
SHA1cf60cb89c49b95bdb585f7af92e17f9e117ddb59
SHA2564686632b5d951fd4c5c13d88252cadcb2373a91c3d6c1c2f5d35587fed1b1949
SHA512d7b597cee12460efe6d990df9115b492045943c6a6979806c953dd773bea58a08b6af75861f29d7fdaa2462526650aaf21ebd60fbd34f8280b236bdf2f1bc05f
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
768KB
-
Filesize
6.9MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB