Overview

overview

10

Static

static

3

2025-01-25...er.exe

windows7-x64

10

2025-01-25...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2025 13:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-25_8bb245bdfd9248935b898fdc750244cd_avoslocker_luca-stealer.exe

  • Size

    3.2MB

  • MD5

    8bb245bdfd9248935b898fdc750244cd

  • SHA1

    4f33fd910523d2087e6321aa17448d47767a76dd

  • SHA256

    57fb756b9b189dada83246d2e2c7bf92ecf43240b0931ce6ec5224c882881c6b

  • SHA512

    d5b2dae8686464d62b1a6acfe5bd05fb8edbd3700bdd1b4ffa56ef839771ff1e55665249d0c9a489333c1b273c3425006b6e883b7ed42d25d472b38c0bc65ab1

  • SSDEEP

    49152:/KKe1YeEAYOW1+M5A8dNRpRNd8T3QeUVjUAujSlc+svqiaKN:iKsW1+M5NdNnRNmT3QeU6Au2EN

Score
10/10
remcoslinindiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

LININ

C2

axaxdad.ydns.eu:4070

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-B1NSAB

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-25_8bb245bdfd9248935b898fdc750244cd_avoslocker_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-25_8bb245bdfd9248935b898fdc750244cd_avoslocker_luca-stealer.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\2025-01-25_8bb245bdfd9248935b898fdc750244cd_avoslocker_luca-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-01-25_8bb245bdfd9248935b898fdc750244cd_avoslocker_luca-stealer.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2348

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat
    Filesize

    144B

    MD5

    4130fd55595b2c85f2ba8fb30ec8c39c

    SHA1

    87f2b652dc71af85acbfd13f7135a42c93b7f293

    SHA256

    f60105d1b10a0876b8544b2cbd39d2e642a31df23599608af2c925eeef7499b0

    SHA512

    10411a387df75b1a0eab8b308ce82b77ceef5adec4a89eb7b0c4d7b5cc50d4a620b94306c398d8dd9886d2eda937c92fdd6df5e9b086315bae0529828327ad26

    Download Submit

  • memory/1232-13-0x00000000007C0000-0x000000000081C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/1232-3-0x0000000000250000-0x000000000027D000-memory.dmp

    Filesize

    180KB

    Download

  • memory/1232-7-0x00000000021A0000-0x00000000024DA000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/1232-0-0x0000000000400000-0x000000000073A000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/1232-15-0x00000000021A0000-0x00000000024DA000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/1232-2-0x0000000000400000-0x000000000073A000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2348-6-0x00000000001C0000-0x0000000000240000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2348-12-0x00000000001C0000-0x0000000000240000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2348-11-0x00000000001C0000-0x0000000000240000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2348-8-0x00000000001C0000-0x0000000000240000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2348-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2348-16-0x00000000001C0000-0x0000000000240000-memory.dmp

    Filesize

    512KB

    Download