Overview

overview

10

Static

static

10

2edf874ef4...d7.exe

windows7-x64

10

2edf874ef4...d7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2025 04:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2edf874ef456146a26d6f4c7836069d48597c01fb7fb569f31013866012a7bd7.exe

  • Size

    235KB

  • MD5

    541bfc55cbbab47729342d1f2ddf0f73

  • SHA1

    72e64bf487c1e971a9fc2f05281299caf90b27c3

  • SHA256

    2edf874ef456146a26d6f4c7836069d48597c01fb7fb569f31013866012a7bd7

  • SHA512

    0dd4b0fc8a4d7aec1846d2bc6a6cc98b11937ae0b99e2d20eb2c1673bed6c867414a8a2646516b895e013f50e326c158d3e1e7c2f12028a7228e9215845cc033

  • SSDEEP

    6144:JQP761yOPJaNOKnod5naEtdpB6JdJf7s/ENdcAcrNOr0/RdVV:JQP7M0NOK3856JzjsAOZrNl

Score
10/10
remcosmanifestblessingsdiscoveryratupx

Malware Config

Extracted

Family

remcos

Botnet

ManifestBlessings

C2

krakencryptotrades.duckdns.org:2025

recoverytrades.duckdns.org:2026

krakenrecoveries.freemyip.com:2026

007lora.varpourtec.com:2026

masterb12.risunn.com:2026

risunn.com:2026

risunn.com:2025

nunubv1.fratellillottini.com:2026

fratellillottini.com:2025
Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-C3DF3D

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2edf874ef456146a26d6f4c7836069d48597c01fb7fb569f31013866012a7bd7.exe
    "C:\Users\Admin\AppData\Local\Temp\2edf874ef456146a26d6f4c7836069d48597c01fb7fb569f31013866012a7bd7.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat
    Filesize

    144B

    MD5

    ef9dc9fb568c05d360f1b0a6a94619be

    SHA1

    438a2ffef5a30f9f7d0b65002f93f0ac217fe63f

    SHA256

    a80aadfa18d62cf92f4c0197e33c1d1356fe19c7eaa162ead3c8030bc091c4fc

    SHA512

    f186cb6ae845b53d3f914555147cd62915c5ee556b806d87e3540f254f98cf83375414233357cee5184fcb4d9ddc9c7f907a668f92ace1b0e1680c3ddebe7d3c

    Download Submit

  • memory/2172-19-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-16-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-7-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-3-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-22-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-13-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-4-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-0-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-10-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-24-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-28-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-31-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-34-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-37-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-40-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2172-43-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download