Overview

overview

10

Static

static

3

ORDER .exe

windows7-x64

1

ORDER .exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4572fbca2bb19a3a6b830db11d55127554eae29b6f84b20807b8d81516d76061

  • Size

    827KB

  • Sample

    241205-lgkkdavjcp

  • MD5

    89a8bee42e1afc21908082d5a8453f67

  • SHA1

    d423bfbc811ca797c2708c4b8901e608aa66d157

  • SHA256

    4572fbca2bb19a3a6b830db11d55127554eae29b6f84b20807b8d81516d76061

  • SHA512

    a0601715f9b561b8d62374f9ae067f7ef3681d5c3a2c0e2f60134a7431cf23de6a811c1105ceffb2fc71d447687a2e3bb11b28a3b97733c7976ea44c474a566d

  • SSDEEP

    12288:iGeZK01R0CsuWrxrRym2LCtecALuCFKozPCX9jMqL3UkHPKvq:i5U01R0CwlT2LCo3u6PCXFM5m

Score
10/10
remcosremotehostdiscoveryevasionexecutionrattrojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.3.64.152:2559

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ZFXG9Y

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      ORDER .exe

    • Size

      828KB

    • MD5

      d23d0195a78fd95ac82c2af1880b189f

    • SHA1

      24aae6c08dd6aac7bdb9396e5ec28816556204c8

    • SHA256

      46316fb80628f5b380834bd245f908aa909d026f62a3e7d0cf88562c8e60b826

    • SHA512

      57fb59343a9b089c29043d4c2b40c85e8c3bf62850d49371d22fe0a1aad170d7e0cb03e54c5e9a7279bd595ade9f05aa370dc3946b2f64e839c3cd4a6ba30706

    • SSDEEP

      24576:/QhNcn5OwvjtHhk3EsJM/fBuyuY10Jq1Z/Z8:4hagwvoTJM3uY10JEZ/6

    Score
    10/10
    remcosremotehostdiscoveryevasionexecutionrattrojan

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks