Analysis
-
max time kernel
40s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-11-2024 05:13
General
-
Target
bo.exe
-
Size
19.4MB
-
MD5
d11df1a50d4bd2946f22579a59c42533
-
SHA1
642658e79c5efcfdf1ece6b24f677868e2e5242b
-
SHA256
c284436ac848ee2ff093e35b1b1a3b75e137adff13c2d3cb070192cd3851bfcd
-
SHA512
0dbe240d77a2e51198e942f0b48dc92f2d3c40f7eac98f957ede80f5809d4efff24a62f7f10e826b70b1459842391a880c39ab651b53809d4a0451778a04fb66
-
SSDEEP
393216:V7HMp6xoUGEbCqiYXygxbisWLvhVARbpQgz+exD9ydNwbOVJs:VzMUWUxCD2nZi9vhVAx1+UDAvwbOw
Score
10/10
Malware Config
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 14 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bo.exe"C:\Users\Admin\AppData\Local\Temp\bo.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c exit2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33.5MB
-
Filesize
8KB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
33.5MB