General
-
Target
2.zip
-
Size
750KB
-
Sample
241224-ljwenatqdn
-
MD5
c301262f4637197233dcd260a173bac6
-
SHA1
78c2a582b2c442322f3272fcf5a18a4f7f357d39
-
SHA256
e1556a64a38cbd56c8264681b8afe29a667ff16f8c3b99ef935525371a14feac
-
SHA512
5d8b19cc54a62f53de1fb3ee65f1b37480f0e3d9e48b998074c2740173756104dd6e5afe84953eac572b05d99854cd41001c5aa44c332d94938426d3bfa0f324
-
SSDEEP
12288:It5yEPV1zujzbEE0T8Gqc1ZdY5GUl3ilkQSfrR2tq8T7QFptBhBJKkq1p1zlr8:It5yEPVWbU9qEzYulTSDR2Y8YFFhBwb4
Static task
static1
Behavioral task
behavioral1
Sample
payment slip..exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
payment slip..exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
remcos
wire 18/12
teebro1800.dynamic-dns.net:2195
teewire.ydns.eu:2195
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-X4SWKO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
payment slip..exe
-
Size
1.1MB
-
MD5
87b1f43499fb88d1971cf2eaf8409cf5
-
SHA1
65013ee9162f40b51049c81f0d5ab8c7971f2ba8
-
SHA256
ae5c7c5f680e962071211f744fac2af5ad9a508ffe60f4bd747e885f017fbeae
-
SHA512
4c3e45ddcba1fc08fd250ba37b02cf50ad0259cea0c1177955de5346838fae30ddd16a37abf5c4d3a90bd4ed9f083debb860e1147c1dbe3564846e21e817c28c
-
SSDEEP
24576:8zcj2wPT+b1WEHsOzj4j85M1hUQDAxzJX4cJeZ:4Av411sOzj4jGM1aK4FX
Score10/10-
Remcos family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1