Analysis
-
max time kernel
177s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-11-2024 20:46
General
-
Target
En virtud del proceso penal en curso, en el que se le imputa el delito de perturbación a la posesi�.exe
-
Size
1.7MB
-
MD5
67df29947d1d3133711d94663b7f2c19
-
SHA1
5716975f7a8c25920a4fb5bab3c3902fd09b59b4
-
SHA256
cfef40e6968cca358390c6872552793be6ccb9f01a0d2f44dce11832bfacf03f
-
SHA512
736f8cc3f3d74b970cac110d66fb2ecbf8ef750fe2914b10b85629bd4d349824e2b6575c1d5821edffd9b5a991de1c18f8091c5e8559bbb29be1f41a1a3d8d19
-
SSDEEP
24576:ZaHyv6exSOI/TRAny+Q57NGylZhkMv+5/JioCb4rl6fNYPGgbib9Fr4jT:Z7vYjRz+Q57NGylv+VQzU8fMcj4f
Malware Config
Extracted
remcos
ZEPTA
ardilla00239.ydns.eu:1833
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
sdfsgfdgdd
-
mouse_option
false
-
mutex
sfgfgdgghdfvfssd-PYRG6H
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\En virtud del proceso penal en curso, en el que se le imputa el delito de perturbación a la posesi�.exe"C:\Users\Admin\AppData\Local\Temp\En virtud del proceso penal en curso, en el que se le imputa el delito de perturbación a la posesi�.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\En virtud del proceso penal en curso, en el que se le imputa el delito de perturbación a la posesi�.exe"C:\Users\Admin\AppData\Local\Temp\En virtud del proceso penal en curso, en el que se le imputa el delito de perturbación a la posesi�.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD5a9e2bddf08f5ad95bccb990ff5950587
SHA1cae7fbd8a3be115029fc8f67504e773e81771172
SHA25678c65b7679156466d83e06ebab57a1e32407195330da02a3dbbb8c032aa6e3b4
SHA512d8bd12173286e414f6dbdddb6a7e472e2e62ce78ed04d17bde60df5b5d28cd4f85dcfd2ad915e6686384320b82738f731bf89f7ecb8b18f915c8596d73996fe2
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
1.8MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB