Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 19:37
General
-
Target
En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe
-
Size
6.1MB
-
MD5
2cede2aef03d4436cac510971c604d10
-
SHA1
1454f28eaf7deb3b33bc9e4beed261f935c2451a
-
SHA256
ac93bb754026e02ece7eb0ac015605b6b7e9e6fa1526def22a4bb3e34569ec59
-
SHA512
808d06c5a7b78ff8ea90ecbb4bfa8f3e1bce0b697736b877860e805521668020af51a479547db7b88f5acb6d5fde43b1579b539ef705a9bfa7d9b7a1d32de91c
-
SSDEEP
196608:N8QTH4OwL4MBQqus0YkuwYMfiUB5NdBD8R3ZZOR:N80H4OwLZBPus0YkuwYMfiUB5NvD03Z6
Malware Config
Extracted
remcos
BLANCO
camino9938.strangled.net:3018
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
registros.dat
-
keylog_flag
false
-
keylog_folder
data
-
mouse_option
false
-
mutex
nhfkkasivbijkewflivlikewf-LIQNJX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Capturas de pantalla
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe"C:\Users\Admin\AppData\Local\Temp\En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe"C:\Users\Admin\AppData\Local\Temp\En este sentido, se le hace un llamado de atención para que se presente ante el Juez del Circuito T.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD524a7ed5344efa863713dae1c2020bd29
SHA160b482f426e2835ee72147234997448121d579ac
SHA2560f440687a40610d668154915abcc4502c0395379b26bfe09027f3191a89bb7fa
SHA512ee038433b3158d5a0c8221f9aa9eb826796557c0681b375bc8fe14799fad82e96d88ec13879f725662b3576fa1777d5b2eed6c6eb0f666a672cca8b85dd4fab7
-
Filesize
204KB
-
Filesize
6.3MB
-
Filesize
20KB
-
Filesize
6.3MB
-
Filesize
100KB
-
Filesize
104KB
-
Filesize
180KB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
100KB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
48KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
6.3MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB