Overview

overview

10

Static

static

3

Payroll List_pdf.exe

windows7-x64

10

Payroll List_pdf.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3dbd6b79ffab366c6725afc3d80ca01359e8ddd59694e4caab3be85b72abc4af

  • Size

    677KB

  • Sample

    250328-ahx2bazvdw

  • MD5

    edbec6cf770d185c4e761f4b4312f205

  • SHA1

    8af4c8101059d16317a775ba414cfa84e1ed0d24

  • SHA256

    3dbd6b79ffab366c6725afc3d80ca01359e8ddd59694e4caab3be85b72abc4af

  • SHA512

    99e7be510f2ee45fdd8bbe42cad82e0370b31095c045a0a7ca9f6bbaf9781dbb1d57401b997490b05bfb814fe551356f6ea59c1db95f97072c5de9f922cf56e6

  • SSDEEP

    12288:kpdY+bBhvxrPOvb1C3d01SwgpT6IKR8XvEm2y5uwvtSZGlUAw4QD6eRehzG0xoVu:kzJBhvkpC3d0MBpT6IrXz2y5uwv0h/6n

Score
10/10
guloaderremcosremotehostdiscoverydownloaderpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:2404

196.251.93.4:2404
Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-LQXWP4

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Payroll List_pdf.bat

    • Size

      831KB

    • MD5

      a262509d9e7799ba517432a2468b826e

    • SHA1

      d72c16f19686bf9afbb89347632eda3703396e90

    • SHA256

      f229c284ec539c5ee4feaea921a24a06c900079b4e8cb4b0965bdbb9f2fcef18

    • SHA512

      81fd20cad8f4a3ae4e4f3638b5242061968535d22032e7003288e59bbd7b0aebd719e39731345b2efbf2f2e66950735b05ae124b44d93a08660f6d0df6459c1a

    • SSDEEP

      24576:JUjfV4MC3d0qTpv6IPX9ky5awvY/X6eR8Mw2:kWt3djZ6IPDRqBXn

    Score
    10/10
    guloaderremcosremotehostdiscoverydownloaderpersistencerat

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      8b3830b9dbf87f84ddd3b26645fed3a0

    • SHA1

      223bef1f19e644a610a0877d01eadc9e28299509

    • SHA256

      f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

    • SHA512

      d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

    • SSDEEP

      192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks