Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
23-11-2024 19:37
General
-
Target
En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe
-
Size
6.1MB
-
MD5
2cede2aef03d4436cac510971c604d10
-
SHA1
1454f28eaf7deb3b33bc9e4beed261f935c2451a
-
SHA256
ac93bb754026e02ece7eb0ac015605b6b7e9e6fa1526def22a4bb3e34569ec59
-
SHA512
808d06c5a7b78ff8ea90ecbb4bfa8f3e1bce0b697736b877860e805521668020af51a479547db7b88f5acb6d5fde43b1579b539ef705a9bfa7d9b7a1d32de91c
-
SSDEEP
196608:N8QTH4OwL4MBQqus0YkuwYMfiUB5NdBD8R3ZZOR:N80H4OwLZBPus0YkuwYMfiUB5NvD03Z6
Malware Config
Extracted
remcos
BLANCO
camino9938.strangled.net:3018
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
registros.dat
-
keylog_flag
false
-
keylog_folder
data
-
mouse_option
false
-
mutex
nhfkkasivbijkewflivlikewf-LIQNJX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Capturas de pantalla
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe"C:\Users\Admin\AppData\Local\Temp\En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe"C:\Users\Admin\AppData\Local\Temp\En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD5aac3e3bef869593d88bb77cea33c8c3f
SHA15c7c9a97744a6e8b2f02d9fc948cddc2f9165d73
SHA2562ee1c24cde886aa31218e770fe5f2867cc5921a496afdd5e0fdf6be1b503707e
SHA51223b25899b90dbaf1dec5bcc4be69bb8e9a311263d69b0b8f3ce4483c7e7cef806336d888ab84ab552c049a24968c68a3f048092bfe63b620672c24cfc542d6f4
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
6.3MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
100KB
-
Filesize
40KB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
100KB
-
Filesize
6.3MB