Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
07-02-2025 14:05
General
-
Target
aa9743c31bf710bcabc63c6ad8f5a807ab12316eedd73feed1d043b39c7a7346.exe
-
Size
1.8MB
-
MD5
051050fd522fd5c484d66cd783b5add4
-
SHA1
9420ab564a73c740bad5e30842ca61c213242230
-
SHA256
aa9743c31bf710bcabc63c6ad8f5a807ab12316eedd73feed1d043b39c7a7346
-
SHA512
0cf52d31f81ebee83e0a0098714c5ee659b34ea81e20a78896d596662aa49c84ffaf057e10a8015530206ed10b287b3bb3add4613af9141c1557ee8df3ec58a1
-
SSDEEP
49152:gTvC/MTQYxsWR7ais+w7GW6vNeKjQO1s17W9OrU:IjTQYxsWRS76Ve0QIs17gS
Malware Config
Extracted
remcos
RemoteHost
192.210.150.26:3678
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-MKYDDH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa9743c31bf710bcabc63c6ad8f5a807ab12316eedd73feed1d043b39c7a7346.exe"C:\Users\Admin\AppData\Local\Temp\aa9743c31bf710bcabc63c6ad8f5a807ab12316eedd73feed1d043b39c7a7346.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\iodite\Sheitan.exe"C:\Users\Admin\AppData\Local\Temp\aa9743c31bf710bcabc63c6ad8f5a807ab12316eedd73feed1d043b39c7a7346.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5702c5dadff19548eb1f82f5eee06678f
SHA1553bdfc6930c371f726d44c2c95216dfb85d54b3
SHA2560e4d9e4053e42919ac04cb3b49fde5d2a4089be27ec4979d6fdb69837a1b70f9
SHA51293bbc922ba1e8fd217f237f351317e26edf23ed203c6c97b387a262a6051db65cd6f34f1fb5ca3323cddbd597518f963ea1a6ad9f188050c3ca0bb10b56c6977
-
Filesize
481KB
MD57bda5fe94b0cdbf12143326ad566036c
SHA1cd36bc46fb1a4d6572accabf7f2071ff0dcd8614
SHA256492f9e19497f8579671f5d1d374c5bfbb8efebcecab6ca7cf83c63bb6ee803a0
SHA51287bb93c34b223c9d0f72ab0a491ab818121bf7f18cfd51b2bd646227bce647c32566671d56505d844ef6af4697e9c0cefe0a053669513c8c1b8f32954f7f31b5
-
Filesize
1.8MB
MD5051050fd522fd5c484d66cd783b5add4
SHA19420ab564a73c740bad5e30842ca61c213242230
SHA256aa9743c31bf710bcabc63c6ad8f5a807ab12316eedd73feed1d043b39c7a7346
SHA5120cf52d31f81ebee83e0a0098714c5ee659b34ea81e20a78896d596662aa49c84ffaf057e10a8015530206ed10b287b3bb3add4613af9141c1557ee8df3ec58a1
-
Filesize
1024KB
-
Filesize
4.0MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
4.0MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB