Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-01-2025 09:47
General
-
Target
1737020816f1d37c8a16b7c2ac46037122c04a811e171262de873311870d863c9b4167e35c702.dat-decoded.exe
-
Size
482KB
-
MD5
79341dbc13c02100fb9ec2ffa8a5e011
-
SHA1
87798cd51faf3996967d8cc377b14eed828d9595
-
SHA256
e3fd8ca4874f45f60b922794a956c9ea8281f748da3959e8131f762af63a1616
-
SHA512
695348d66c2bedc753344de0a59bb8fc05dbfdb2c52f9cdbb392d6ad37109a70ead8f4fd8cb2b3151174616eaaa64981ece3694f1c1f17ed34d2b87fa79cd224
-
SSDEEP
12288:x13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQES:jak/mBXTV/R0nEF76gFZH
Malware Config
Extracted
remcos
RemoteHost
172.245.123.12:8690
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ET2B3I
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Detected Nirsoft tools 8 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1737020816f1d37c8a16b7c2ac46037122c04a811e171262de873311870d863c9b4167e35c702.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\1737020816f1d37c8a16b7c2ac46037122c04a811e171262de873311870d863c9b4167e35c702.dat-decoded.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1737020816f1d37c8a16b7c2ac46037122c04a811e171262de873311870d863c9b4167e35c702.dat-decoded.exeC:\Users\Admin\AppData\Local\Temp\1737020816f1d37c8a16b7c2ac46037122c04a811e171262de873311870d863c9b4167e35c702.dat-decoded.exe /stext "C:\Users\Admin\AppData\Local\Temp\apjntmltjqqmbhziaqcyrpjmmputtu"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1737020816f1d37c8a16b7c2ac46037122c04a811e171262de873311870d863c9b4167e35c702.dat-decoded.exeC:\Users\Admin\AppData\Local\Temp\1737020816f1d37c8a16b7c2ac46037122c04a811e171262de873311870d863c9b4167e35c702.dat-decoded.exe /stext "C:\Users\Admin\AppData\Local\Temp\kjoxtewvxziqdnomkborucedvemcufnbk"2⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1737020816f1d37c8a16b7c2ac46037122c04a811e171262de873311870d863c9b4167e35c702.dat-decoded.exeC:\Users\Admin\AppData\Local\Temp\1737020816f1d37c8a16b7c2ac46037122c04a811e171262de873311870d863c9b4167e35c702.dat-decoded.exe /stext "C:\Users\Admin\AppData\Local\Temp\vluqmw"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD52d49f1a33745cbaf2bfe3ee8328e242b
SHA1a93b5d709b41f2b112ab16d1b5ad8de426f440e5
SHA2564a5190edd648ceb67252ab0e598fc013cd5232d7efb9d97fb2650416881399b9
SHA5127e500b24ec3a63559fac39e65f41457903a699f596dfae73d9b7f4c8ff1710fa8f056b8c7f504af21b01b071ee1c3b7a743cbbeb867d8a1b02a0cdce69476fb8
-
Filesize
4KB
MD5562a58578d6d04c7fb6bda581c57c03c
SHA112ab2b88624d01da0c5f5d1441aa21cbc276c5f5
SHA256ff5c70287ba432a83f9015209d6e933462edca01d68c53c09882e1e4d22241c8
SHA5123f6e19faa0196bd4c085defa587e664abdd63c25ef30df8f4323e60a5a5aca3cd2709466f772e64ab00fe331d4264841422d6057451947f3500e9252a132254e
-
Filesize
100KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
100KB
-
Filesize
512KB
-
Filesize
100KB
-
Filesize
512KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB