Overview

overview

10

Static

static

1

CF_0283873...21.exe

windows7-x64

8

CF_0283873...21.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CF_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe.zip

  • Size

    884KB

  • Sample

    250128-rff4fs1kfy

  • MD5

    07c03c1d69caeec962a1990707b5cfc6

  • SHA1

    f6fa4af9e163c1b320cbdcc8416622fe23223e1c

  • SHA256

    b4c7126ea64492844a32fa690159c50e084c9668f00bca82e5e05b16a61c3581

  • SHA512

    b736d75a6202cd7727f7fbf94667d45cb1908249c55ae3fe63a09d3575b3f93f748f218a1aa37155537fdff4e0850fbd5490811271feffe26572415b05175600

  • SSDEEP

    24576:FacIm/sVqnSpy7GjVyCt434lkc9bLXAOJvw:kdFV4Sg7KYCt4kZAOJvw

Score
10/10
remcoscheapcollectiondiscoveryexecutionpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

CHEAP

C2

suregigg2.redirectme.net:4689

suregigg2.redirectme.net:4688

oaziamaka.duckdns.org:4688

oaziamaka.duckdns.org:4689
Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    aleopty.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    deocheapnsgb-EHE212

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      CF_028387373736_Copies_6761fa19c0f9d_293874738_IMG__REF2632737463773364_221.exe.bin

    • Size

      1.2MB

    • MD5

      fc4142d5de060352acc29286128c2321

    • SHA1

      e658fb2a13ccb724a571c7e3f86be0f1cf3bdbe7

    • SHA256

      3803129beac3434b84cf1fd8f14e9bed663d631aab34bd30f99f1713fcb11527

    • SHA512

      0d6a5584ce4ac10cc5501e574c2bdf580bb90403133a47b4264d80cbee93dff3cc399f802245dbae5f8c538b6c4a2f724818de7563c8889e4883fd4c87589cfa

    • SSDEEP

      24576:LsyGgD2tDaxQN6bwbS5nrm9utI2SnS4ZxZ:Lsy0OQNFKq8MZxZ

    Score
    10/10
    discoveryexecutionremcoscheapcollectionpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks