Overview

overview

10

Static

static

3

Order Inqu...dp.exe

windows7-x64

10

Order Inqu...dp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order Inquiry Sample (2).zip

  • Size

    807KB

  • Sample

    241219-ny66tatldr

  • MD5

    125147879ab01ea810e61fce097f6666

  • SHA1

    3990e6a41ca32ffb93bf7d29d369e5226a73809d

  • SHA256

    5c4b26f4a1093361e2d2935343e6143541c151986fe8249cc3ef30968f118544

  • SHA512

    526e2eddf5b054da4cbf5ac2949dfa75e35b04032aa354fc2e9b3151f8369518c3686fab83edb2b78fca2b4c4132c310c71bc43e31b9a5b372d45296e7adfe5c

  • SSDEEP

    12288:v8BjpK3v4kLIsMdA02joCicremIuHvWPfqEHCZgUsfQDCopPp1FdqDVNeB:EP0vXLIMP+mPvWKAfwnBPdqDc

Score
10/10
remcoswire 17/12discoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

wire 17/12

C2

teebro1800.dynamic-dns.net:2195

teewire.ydns.eu:2195
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-CXQHPD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Order Inquiry Sample/Order Inquiry Sample.‮fdp.exe

    • Size

      1.4MB

    • MD5

      4918286bab253571011dca91a94c7a9d

    • SHA1

      df4f5740aa5c17a6bab7f7df761f4485847bb1b9

    • SHA256

      1d2318e3dc389cff6b70d6fb54e36d3af39c4953e10593f4cbb446f58788966d

    • SHA512

      92cc906208c8895669cfa826813c2613aaf2eeb823d3c2482e8a3eb35a2e7ece94ef65006ebeb0338fc1dbadf638c083defecc0f202308fc62549feb1b0a54b1

    • SSDEEP

      24576:TwJXLIjOU0HsOzj4j85M1hUQDAxzJX4wwI:kJXcjcsOzj4jGM1aK4FX

    Score
    10/10
    remcoswire 17/12discoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks