Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-12-2024 08:17
General
-
Target
6f0604f8a16b94b61d714dfec11d0358.exe
-
Size
865KB
-
MD5
6f0604f8a16b94b61d714dfec11d0358
-
SHA1
558828c2ead68ea5883655299a3f0bfad1981ae5
-
SHA256
28331e2705bf58bd76a9f8ba0f0a431b762eaf6e4284dbf12f1453dd3fecf281
-
SHA512
76ebd74ec7b965ff20aad25aa6c0dfc5b7efef087f6bd4bf6f0b2f08427ac65bf320305db16ff00cebc5bfc98c8f22014ed5e7c9cedd37a05721b330326c4eb3
-
SSDEEP
24576:drl6kD68JmlotQfAVnxag+/zxRlk4t4p5G5wJm1wr:Zl328U2yfAVnsgSWpg5km
Malware Config
Extracted
remcos
RemoteHost
192.210.150.26:8787
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-R1T905
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f0604f8a16b94b61d714dfec11d0358.exe"C:\Users\Admin\AppData\Local\Temp\6f0604f8a16b94b61d714dfec11d0358.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Milburr\Allene.exe"C:\Users\Admin\AppData\Local\Temp\6f0604f8a16b94b61d714dfec11d0358.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Milburr\Allene.exe"C:\Users\Admin\AppData\Local\Milburr\Allene.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5c7b90bc3c13a6cc06c59b15d370350f9
SHA14d5051a6d86d06aa5d79e2fe20e1af4a3e05a063
SHA2569dae17067aa1c2ecd2843a8a78b59494f6ecc68a671f3fc64d01a02ba3d0cf3d
SHA512235121a7f1f4f102060952e8b6c0b86c73ce53fae36d655146c9804d08dfccc51ba6f822c8d3817b769319478977968d3543c7df174b9b01834add413b042dfd
-
Filesize
865KB
MD56f0604f8a16b94b61d714dfec11d0358
SHA1558828c2ead68ea5883655299a3f0bfad1981ae5
SHA25628331e2705bf58bd76a9f8ba0f0a431b762eaf6e4284dbf12f1453dd3fecf281
SHA51276ebd74ec7b965ff20aad25aa6c0dfc5b7efef087f6bd4bf6f0b2f08427ac65bf320305db16ff00cebc5bfc98c8f22014ed5e7c9cedd37a05721b330326c4eb3
-
Filesize
481KB
MD53cb6abd40fba1eddd8a7dda9994ba7f7
SHA12c563fad704a5e5407f38aff2e47c72138944106
SHA2564b2e35d8cd82164975b338e118ebfbd621d1afb5e768a12936f7f9d0b6c1b9e0
SHA512ca9c2b1deaf0da7db93ad63cf98010ef28d5b07e50213984842996a14796ae88e774583f487510f1860cbdd5b58cf51523f928c8fde6622f80352cac6ba7b77f
-
Filesize
414KB
MD5cbdee7e56fe6e632838a31adf1435807
SHA19ac24bd12e4369785742e075f81b9b6a50ebabbd
SHA256dc44aee08535cfca123fe35ec2ee62e4d0457a82a370f709e6bdc95b9f26f11c
SHA512e058194d24bcbb56638e3e63e0e50d2f4fa2a6956dc57eaac73e11f215190940b5ab3744df567ffe1a29b7d324422b3ded9e339e1188f910bbc6ec32496e72a9
-
Filesize
1.9MB
-
Filesize
4.0MB
-
Filesize
1.9MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
4.0MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
1.9MB
-
Filesize
508KB
-
Filesize
4.0MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
1.9MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
4.0MB
-
Filesize
1.9MB
-
Filesize
1.9MB