General
-
Target
136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94
-
Size
1020KB
-
Sample
241222-ymjaqaxpcj
-
MD5
cf267581be8473ea55c73b833a6e0dad
-
SHA1
b1c43239677655b821f290dbbf1be560fbbeaca9
-
SHA256
136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94
-
SHA512
3d65fb0a6536977dc30a545b018f02ebd6be27c3f4da34fac6ed55716ff83996e9f493f2497ce6f8b8e0a71a84c7b79dad3f4e3ca40e84b723bdda4592583938
-
SSDEEP
12288:1feDOa9rDeYSorINpj5XqkJD0QrOod7XxlW91RRep+rgRNyA55IxJ2DWzzY8:ED39v74lfGQrFUspugRNJI2DWzz9
Static task
static1
Behavioral task
behavioral1
Sample
136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe
Resource
win7-20240903-en
Malware Config
Extracted
remcos
Host
213.183.58.19:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
read.dat
-
keylog_flag
false
-
keylog_folder
CastC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_sccafsoidz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
remcos
1.7 Pro
Host
213.183.58.19:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
read.dat
-
keylog_flag
false
-
keylog_folder
CastC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_sccafsoidz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94
-
Size
1020KB
-
MD5
cf267581be8473ea55c73b833a6e0dad
-
SHA1
b1c43239677655b821f290dbbf1be560fbbeaca9
-
SHA256
136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94
-
SHA512
3d65fb0a6536977dc30a545b018f02ebd6be27c3f4da34fac6ed55716ff83996e9f493f2497ce6f8b8e0a71a84c7b79dad3f4e3ca40e84b723bdda4592583938
-
SSDEEP
12288:1feDOa9rDeYSorINpj5XqkJD0QrOod7XxlW91RRep+rgRNyA55IxJ2DWzzY8:ED39v74lfGQrFUspugRNJI2DWzz9
-
Remcos family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1