Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-12-2024 08:11
General
-
Target
f3c6c680b66ef4a132e3a9b61b83622d.exe
-
Size
856KB
-
MD5
f3c6c680b66ef4a132e3a9b61b83622d
-
SHA1
c720cc4ff63d365458e9be977ed692263108dc87
-
SHA256
e51f50b3f520e3de0f0916e0291ad093aa0c50f6c81010001ce5aa2aee88f7b0
-
SHA512
331daf042e405db03632781216131b5495af8ad3f024623757f56b45957bcb0cabc5fa8d08252aa613b03f0e07a685ae60cb260deaa6eae11745f8283750f5a2
-
SSDEEP
24576:Erl6kD68JmlotQfwmqmLQjmVlWGEeXqhaf:yl328U2yfwmjQm1EeXY
Malware Config
Extracted
remcos
RemoteHost
192.210.150.26:8787
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-R1T905
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3c6c680b66ef4a132e3a9b61b83622d.exe"C:\Users\Admin\AppData\Local\Temp\f3c6c680b66ef4a132e3a9b61b83622d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Sancerre\nonhazardousness.exe"C:\Users\Admin\AppData\Local\Temp\f3c6c680b66ef4a132e3a9b61b83622d.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD51fc83b739b2c1825ef407e4ab5854fd2
SHA1aba364c3acf002881c588ae51ed3da1cfe98ae97
SHA25647ec571f59cec31c47b646bbea28e9f79366bb169db1d3f0149e7b15e09187ca
SHA512b53bbcb9ff9223e482a0a1f31b3660c98b29f739675e9122043495f0c90798621dc0b24f54915f7b114eb025ca6f4af5b9094416dfa8115a62673779c89dc387
-
Filesize
856KB
MD5f3c6c680b66ef4a132e3a9b61b83622d
SHA1c720cc4ff63d365458e9be977ed692263108dc87
SHA256e51f50b3f520e3de0f0916e0291ad093aa0c50f6c81010001ce5aa2aee88f7b0
SHA512331daf042e405db03632781216131b5495af8ad3f024623757f56b45957bcb0cabc5fa8d08252aa613b03f0e07a685ae60cb260deaa6eae11745f8283750f5a2
-
Filesize
481KB
MD55da0e2a6af58f3c61e2a9d03160b0be6
SHA1077b3fb750beb67eb8615c3101ceb91e2c9f8ca1
SHA2566412b25824b53394b1b61f6dad679d0701f99dd9daa27a3fd1893ab0d5883fd8
SHA512166ea3de661e775bc46ebdcdeb70337d1692a73beb8450d3251c327c3364d70ced003467e3574a874fba599a834bd5bd07697adf3e6f78b52dd410988c64b90b
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
1.8MB
-
Filesize
4.0MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
4.0MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
1.8MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
1.8MB
-
Filesize
4.0MB
-
Filesize
1.8MB