Overview

overview

10

Static

static

200630 Klo...bH.scr

windows7_x64

10

200630 Klo...bH.scr

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    200630 Kloepfel Consulting GmbH.scr

  • Size

    680KB

  • Sample

    200630-fpvjq7vsen

  • MD5

    cd8d11d11a4a2c38bfb1ba89a9e8cef6

  • SHA1

    27cdc50b73ce48a9d2e773fbda57fe11a67a1d40

  • SHA256

    9d288f2ea49daa4323d1a496c42cbffdfbb148b634345ecc9147265bbdc43491

  • SHA512

    d7efb6e34026658f0e098c028f7613ace62c36e5d10fd64185f5d5b1bb3d0d95e100e164512032d404c265c9ef448ff69c4c2055ad81a2bdff6f64d2972e27da

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

coronanancy14-50163.portmap.io:50163

Targets

    • Target

      200630 Kloepfel Consulting GmbH.scr

    • Size

      680KB

    • MD5

      cd8d11d11a4a2c38bfb1ba89a9e8cef6

    • SHA1

      27cdc50b73ce48a9d2e773fbda57fe11a67a1d40

    • SHA256

      9d288f2ea49daa4323d1a496c42cbffdfbb148b634345ecc9147265bbdc43491

    • SHA512

      d7efb6e34026658f0e098c028f7613ace62c36e5d10fd64185f5d5b1bb3d0d95e100e164512032d404c265c9ef448ff69c4c2055ad81a2bdff6f64d2972e27da

    Score
    10/10
    persistenceratremcos

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run entry to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks