Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-12-2024 10:24
General
-
Target
e6d45fee9be6000a6263caa74d5486d42bc367a165bee0fd07d2f19b58020b16.exe
-
Size
1.8MB
-
MD5
3135d0f8093dc3107321b482c7e37d8e
-
SHA1
befbb43592109a68e5c1f2ef2705d8667c5d01fe
-
SHA256
e6d45fee9be6000a6263caa74d5486d42bc367a165bee0fd07d2f19b58020b16
-
SHA512
53fd22e923f5dfb3e81d657d246a45594ef35181e2314b51b71dce2fb5d2c10745882e10114a021a1d135b25e494a1f126c7c3cf9f57d52b63861d2b7321e36c
-
SSDEEP
49152:b1KbybCTobrZJJauPgYiebG+87+chNGyLTH9S9R0Z4wsFWsGJUBZlEyu6BMVR0jD:wS9RthzAw
Malware Config
Extracted
remcos
sol
formationslistcomplet2.sexidude.com:30201
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
registros.dat
-
keylog_flag
false
-
keylog_folder
registro
-
mouse_option
false
-
mutex
qazxswedcvfrdsasxzcew-08IRA2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Capturas de pantalla
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6d45fee9be6000a6263caa74d5486d42bc367a165bee0fd07d2f19b58020b16.exe"C:\Users\Admin\AppData\Local\Temp\e6d45fee9be6000a6263caa74d5486d42bc367a165bee0fd07d2f19b58020b16.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e6d45fee9be6000a6263caa74d5486d42bc367a165bee0fd07d2f19b58020b16.exe"C:\Users\Admin\AppData\Local\Temp\e6d45fee9be6000a6263caa74d5486d42bc367a165bee0fd07d2f19b58020b16.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD53d64cebd3a64683e49e1b12cd20ce3b5
SHA19c56db1b845990a7a61276e064d28212ed137d2c
SHA25675144c4a00666334aee067d82a5067e3d8e4585da9b7b18e45837853105dc7f0
SHA512a01359f28210caacdaa9ff80087134979e18880c0479d9cf74d3d291c1d2da2173a550a707e9ce3e1366492658675026f17f1f399c9d3a18c720f380a0502101
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
52KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
52KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
1.8MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB