Overview

overview

10

Static

static

1

INV_642421...df.vbs

windows7-x64

10

INV_642421...df.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INV_642421346_50136253995_SIMPLE_SKpdf.vbs

  • Size

    33KB

  • Sample

    241129-k8f6lasnbm

  • MD5

    5c4cdb5cdd819889856451945d0e3421

  • SHA1

    90ee3b5a6ae37568bf0e8cb5769c602a851ae45a

  • SHA256

    eaaeb54bc1f3cd1f7f3b6a26b608ce60e226ae8f54d0626187c6fc42562e3d67

  • SHA512

    fd62004cd1a591cf9b1aa0ad581bad976a7f75881c025cc5e4b674d45d543104c25f8cbb853cd772e5cbbcf85873a682b64be4eae6c532921e5bfa275405af44

  • SSDEEP

    768:xFeasDMIvJVT92xONnuJOK48hZVAe/NOVVg5+rS9JL7ZZ:Heas/JuAoj5/L0S5+e9J7z

Score
10/10
remcosremotehostdiscoveryevasionpersistencerattrojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

8766e34g8.duckdns.org:3782

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-93TSMD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      INV_642421346_50136253995_SIMPLE_SKpdf.vbs

    • Size

      33KB

    • MD5

      5c4cdb5cdd819889856451945d0e3421

    • SHA1

      90ee3b5a6ae37568bf0e8cb5769c602a851ae45a

    • SHA256

      eaaeb54bc1f3cd1f7f3b6a26b608ce60e226ae8f54d0626187c6fc42562e3d67

    • SHA512

      fd62004cd1a591cf9b1aa0ad581bad976a7f75881c025cc5e4b674d45d543104c25f8cbb853cd772e5cbbcf85873a682b64be4eae6c532921e5bfa275405af44

    • SSDEEP

      768:xFeasDMIvJVT92xONnuJOK48hZVAe/NOVVg5+rS9JL7ZZ:Heas/JuAoj5/L0S5+e9J7z

    Score
    10/10
    remcosremotehostdiscoverypersistenceratevasiontrojan

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • UAC bypass

      evasiontrojan

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

Network Service Discovery

1
T1046

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks