Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 12:03
General
-
Target
1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe
-
Size
481KB
-
MD5
395a60d305eca089d0339e1f3cb58e9a
-
SHA1
9910634adf12d8ebb2ba615c25561a60d6af1723
-
SHA256
6cdbfdc2021a53982577b8707e68d5ee91243647ed86197f1e78ba042302d389
-
SHA512
7fdf773d95a034a9042d91c3625a57ff98bcabfb54e0278958990c673aa0eddcf24bfadddbbb1859a14cfa63ad409b3eb33331ca52f5d0cc5b0a48917a117161
-
SSDEEP
12288:nuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDS/+DY:a09AfNIEYsunZvZ19ZMs
Malware Config
Extracted
remcos
RemoteHost
216.9.226.100:3898
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
mic
-
mouse_option
false
-
mutex
Rmc-Q9T2QD
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Detected Nirsoft tools 9 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exeC:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe /stext "C:\Users\Admin\AppData\Local\Temp\jnkpyhuwhmrgnzmhpkmvprolmzmyiht"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exeC:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe /stext "C:\Users\Admin\AppData\Local\Temp\lhpirzeyvujlxgjlgvzxawjcufezbskbxk"2⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exeC:\Users\Admin\AppData\Local\Temp\1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exe /stext "C:\Users\Admin\AppData\Local\Temp\vcdasr"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5fa130f8055ba148dc5ccc5e75ac785c7
SHA1e20d3403c6dcde21b872feda89139ce857b6b821
SHA256035bbf1461fe6522dc53c1935851ffcdd47f9993237296eda7f42e7a58bfb401
SHA5121414de307655e8a7d8558f7c947d5a2e36cb1c5f40fed9ab1100334e4cff4fe54bd227bd509b6f3e2c5aa7d007e7af85735fcd41630df61c42d70c58d78241b2
-
Filesize
4KB
MD5bc25ccf39db8626dc249529bcc8c5639
SHA13e9cbdb20a0970a3c13719a2f289d210cdcc9e1d
SHA256b333f8c736c701bc826886f395d928731850cbce6db77be752b3cf7979114904
SHA5129a546127bddc1d187e674cda82e6c5046cac7f3e6f9515aed68d5bff2264b9d679d857dd97270e10826cd11ce2d92d82dd7f9801e19027e346b60bcc814cca1a
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
804KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB