Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-12-2024 15:34
General
-
Target
DEMANDA LABORAL JURIDICA 165161.zip
-
Size
6.1MB
-
MD5
c1aa4fa22d173ced8f486a204a1ae7ba
-
SHA1
cb5ebbb275be1aba5b876d97160ce3c707ac4d18
-
SHA256
6be3ef4c945c9c46527b9cdf595a5810753b4b39bacbc6b078d0153fc91d7b85
-
SHA512
2bae65ffa4dc001784e5de6858365ef441813f83dd2250aa644d65cfb91a73bc8139be4ede6105000d0a5f1d9a9c95e33cde17b49eeb291e9671a85948fdad08
-
SSDEEP
196608:RXM1Rlx6A5LEqEoHkriDlKsvYshOXXz1YB:RX6Rb6UgqbEriDlNhOHpYB
Malware Config
Extracted
remcos
RemoteHost
december02.kozow.com:5151
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-O92SE5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL JURIDICA 165161.zip"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\DEMANDA LABORAL JURIDICA 165161\1 DEMANDA LABORAL JURIDICA 321321.exe"C:\Users\Admin\Desktop\DEMANDA LABORAL JURIDICA 165161\1 DEMANDA LABORAL JURIDICA 321321.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "G7EJdZoaViCVgUwk" /tr "C:\Users\Admin\AppData\Roaming\1 DEMANDA LABORAL JURIDICA 321321.exe" /sc onlogon /rl highest /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "G7EJdZoaViCVgUwk" /tr "C:\Users\Admin\AppData\Roaming\1 DEMANDA LABORAL JURIDICA 321321.exe" /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\DEMANDA LABORAL JURIDICA 165161\1 DEMANDA LABORAL JURIDICA 321321.exe"C:\Users\Admin\Desktop\DEMANDA LABORAL JURIDICA 165161\1 DEMANDA LABORAL JURIDICA 321321.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "G7EJdZoaViCVgUwk" /tr "C:\Users\Admin\AppData\Roaming\1 DEMANDA LABORAL JURIDICA 321321.exe" /sc onlogon /rl highest /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "G7EJdZoaViCVgUwk" /tr "C:\Users\Admin\AppData\Roaming\1 DEMANDA LABORAL JURIDICA 321321.exe" /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5356bda2bf0f6899a2c08b2da3ec69f13
SHA1b9807b8840327c6d7fbdde45fc27de921f1f1a82
SHA256358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69
SHA512aae5102e2648d1c211e6f9b59a3de1dcc6143a5bd709c51bc9e4a9dd66cab593ad4c0962d2044634a772b0bc66e7c0adcea832a53573a30e7af7d88df3cd201f
-
Filesize
481KB
MD534e7858467bd37a5fe1b75dcd73bdf19
SHA160677610b2c666cca1c212b66441231cea964434
SHA25611cdb65e5b007e249a51a7410da0653ec6c6b28f68b33e1de88ac3989dd745d6
SHA512bb6ea5a30f6060dd68ef51a3cfcff76a20337155eb3ac95a0fdd19240782d07d947046788833983483908728f7f119fc858930ba9d80b823f7e3582054824ac9
-
Filesize
121KB
MD59c521a90653df5d1efbd0cea12318863
SHA1ec2afaf10b78dabfead9e9e485d454789c244188
SHA25685bcfc9de06bd0751245ad882f7e2141f340cdedefcaefb8deabbc0792088a58
SHA512d1bbb5e07e7df5fe6da9786ecee06c0dfd9e46067de48a139323aa045f81139b78404c4f3f77b1f6f58c3b11d1edf88d0c06ad42fcf7482436367f2444e6152e
-
Filesize
2.6MB
MD5e2e01305e938ea378a88658d81c0917f
SHA16b3dc7e13347f6fadadc2dbac7d3a3927d9e2aa6
SHA25629c3c48f4dc84e7179881bc3767546878b2db89d418372f687edbd4a72ef0989
SHA5125620ea58d2a7da0fe5d352ea1fe82e76ed84c31b2ae97b28a3ab3b25268f21c0a8eef8ca7baa05ab0f2c80a8125fc7e2441065eda11259b1f636be7b3d6c202d
-
Filesize
6.8MB
MD5faa78a3123a7f231de7152bb15c7fa02
SHA1c9562133f7630db6a84f4daf56b468c5b0891704
SHA256e68265f0d7012e600dac0a25190c6bf4c65689165cb2cb31a60a37baad21064f
SHA512622f9da91e1f4995136515120c6a2f5e7f43eb2007467d2633b7391c2777985b2557647ec7753c28d34014d5e83bc979298c245f2b3d6562e668d5c2e221faa4
-
Filesize
6.0MB
-
Filesize
6.8MB
-
Filesize
6.8MB