Overview

overview

10

Static

static

3

Swiftcopy_...df.exe

windows7-x64

10

Swiftcopy_...df.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a6361629e1199641cdd584a8fbeb88772caeec26d2435a7dfa82e1204a388ac6

  • Size

    381KB

  • Sample

    250108-dfmdkstkap

  • MD5

    3785c67e4811cc8a6a403df4fd40077a

  • SHA1

    a0e1d783ea76d10a82fdf1923d824a09df91c62a

  • SHA256

    a6361629e1199641cdd584a8fbeb88772caeec26d2435a7dfa82e1204a388ac6

  • SHA512

    1c282438b0f4b83121faca7fe12161e75853850afa838cc1ad9298cf4f59f89716342505dae4dbcedbfcd9ba8d23b8c08546c32e931bdb5f116fb850f10e61a3

  • SSDEEP

    6144:FH3QgicalndP+ps9isv+6u5/0G/artbd9PGZw+S/2ymgayvgc4uzwCXPWFFYarNB:FHggicendPbVvBu97/ar/v5+ylayvglF

Score
10/10
remcoswealthbillionairesdiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

WEALTHBILLIONAIRES

C2

wealthabundance01.duckdns.org:3981

wealthabundance01.duckdns.org:3980

wealthabundance002..duckdns.org:3980
Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    wealthymannow-JW6AZS

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Swiftcopy_MT103_Balance_Payment_Confirm_Reference000000000000000000000000_pdf.bat

    • Size

      393KB

    • MD5

      57393c77384cc2d9de469c0e386e253a

    • SHA1

      4b09dd1a1920c0b27c50496644ae280a7aed8514

    • SHA256

      24b91dce786728cf40606d390ea7098e51a3141de8fb26eac68997913be81033

    • SHA512

      bcd5a20047b281ae1ec2195eacbcc1fd78147b6a95b54707a24bdd0698dbb8fb06d7051b8ac1a9453d9d945e5dd285b45eefa758dc589204aac2b419811f08c4

    • SSDEEP

      12288:cATgiCendPxVVBO97/arTvV+yvayvgluzpn4H3:cAJCK9jVBOB/KraTX

    Score
    10/10
    remcoswealthbillionairesdiscoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks