Overview

overview

10

Static

static

purchase o...ly.exe

windows7_x64

10

purchase o...ly.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    purchase order for july.exe
  • Size 531KB
  • Sample200709-frvs7exrtx
  • SHA256 74c74bc92e1e2b1fbec04160533ddc46adfd8e2f691295ad4a08cbd83e01adc7
  • MD5 SHA1 SHA512
Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

  • remcos

C2

  • 194.5.97.18:6642

  • gozman11.duckdns.org:6642

Targets

    • Target
      purchase order for july.exe
    • Size 531KB
    • SHA256 74c74bc92e1e2b1fbec04160533ddc46adfd8e2f691295ad4a08cbd83e01adc7
    • MD5 SHA1 SHA512
    Score
    10/10
    persistenceratremcos

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks