Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-01-2025 14:35
General
-
Target
0x0025000000046617-2188.exe
-
Size
915.2MB
-
MD5
a084c1b14eefc00c8adf95faba838f71
-
SHA1
2cc59b80e92d1e5facebbd3646b0ec2972e994d0
-
SHA256
b0154e35bd08a554b64f0ec61cb1c2fe766c96f2ad56124851fbb46a7a4d67bf
-
SHA512
68e4c0d09fa1fb18c6726cc1f51e37584a746543bb3498fbd6775a7e3505a6a36986c7ccfe212d40cce10588ddf76e5b707181ce545dc5e17fc37728041e395c
-
SSDEEP
24576:2UX4dOOOjXBaykZ+1X80ikrNL2dOOONUu8T2GhOOPiE3OAHwnBqk38wAyBnaAqmX:vIdKRDXlrNadfTXPR31QnBz38wAkaAk
Malware Config
Extracted
remcos
gozo
newstaticfreepoint24.ddns-ip.net:30201
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
registros.dat
-
keylog_flag
false
-
keylog_folder
data
-
mouse_option
false
-
mutex
lmajjdnchhdybagtqbsjsjdjjskshs-PPNSD0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Capturas de pantalla
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Downloads MZ/PE file
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x0025000000046617-2188.exe"C:\Users\Admin\AppData\Local\Temp\0x0025000000046617-2188.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD56b2e49b996290e1606b80d142562c04e
SHA1d9c769d15aa57f339f4287345c0ef55f6aa512ec
SHA256d24b0d2d104e5f1b9a848833f099882ceadba8444fb8d6e7903f9169b7e9980c
SHA512eba094d62f342b0406be59afe0de69181cf22fd2ae1bbd1a7b5952b0e5dc2521fbf61566b9541dda9efff31da8e4323f4735c709054b056c50814dbddb9e69c2
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
800KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
64KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
568KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
344KB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
164KB
-
Filesize
352KB
-
Filesize
508KB
-
Filesize
508KB