Overview

overview

10

Static

static

1

CustomerWi...21.bat

windows7-x64

8

CustomerWi...21.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CustomerWishlist21.bat

  • Size

    4KB

  • Sample

    250204-tser9stkfl

  • MD5

    bd4396aedb58de076a84d0f7f9fab0df

  • SHA1

    66a7473cc33384cf9585f1d4fac71c72bddf4b73

  • SHA256

    138e68456c1008ee1a966b6a1eb440a1e5bb5c5d7b2390f4e8c4cbe659493896

  • SHA512

    cfc0bdfaaed8afc8d05824d14f31a542a68f8d91aea64184011477dedea63ffbb71dc5e4283cca064c6c8b3027d53373903efe2b300f9b44f1fbd2e13259f4f6

  • SSDEEP

    96:bQqXcRSG3A1VAAAlI6AdAhJipD2AEEkAYDABAR3CA0rAdOLn6VA/oxAOgAPZPh3:bQqsRA1VAAAfAdAhU52AOAYDABAIA0rW

Score
10/10
remcosede81263et817discoveryexecutionpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

Ede81263Et817

C2

www.bilkosmpis.fi:6961

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Bilk8262Wb-JN9J2K

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      CustomerWishlist21.bat

    • Size

      4KB

    • MD5

      bd4396aedb58de076a84d0f7f9fab0df

    • SHA1

      66a7473cc33384cf9585f1d4fac71c72bddf4b73

    • SHA256

      138e68456c1008ee1a966b6a1eb440a1e5bb5c5d7b2390f4e8c4cbe659493896

    • SHA512

      cfc0bdfaaed8afc8d05824d14f31a542a68f8d91aea64184011477dedea63ffbb71dc5e4283cca064c6c8b3027d53373903efe2b300f9b44f1fbd2e13259f4f6

    • SSDEEP

      96:bQqXcRSG3A1VAAAlI6AdAhJipD2AEEkAYDABAR3CA0rAdOLn6VA/oxAOgAPZPh3:bQqsRA1VAAAfAdAhU52AOAYDABAIA0rW

    Score
    10/10
    executionremcosede81263et817discoverypersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks