Overview

overview

10

Static

static

1

Request fo...on.exe

windows7_x64

10

Request fo...on.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Request for Quotation.exe

  • Size

    241KB

  • Sample

    210223-nzxy42x2fn

  • MD5

    ae4bd6c5a7eaa50704d43d6054fc5dbd

  • SHA1

    ab597cfc0433999f2032c56fe2c9e17081bcab46

  • SHA256

    8e51354c8b2f461ab0cfb92409bc45bf4e06ae244080513e2d6224dc22f47771

  • SHA512

    b7b0b772a5e9e969f3d5389c1c12f053a5b3a7aa774fffa3a2dac8903df09a2a6b9d242a4f1fb63602d7581226ec647be44139d27aacd82dbec6242bcd3bab43

Score
10/10
remcosratspyware

Malware Config

Extracted

Family

remcos

C2

103.89.88.238:4299

Targets

    • Target

      Request for Quotation.exe

    • Size

      241KB

    • MD5

      ae4bd6c5a7eaa50704d43d6054fc5dbd

    • SHA1

      ab597cfc0433999f2032c56fe2c9e17081bcab46

    • SHA256

      8e51354c8b2f461ab0cfb92409bc45bf4e06ae244080513e2d6224dc22f47771

    • SHA512

      b7b0b772a5e9e969f3d5389c1c12f053a5b3a7aa774fffa3a2dac8903df09a2a6b9d242a4f1fb63602d7581226ec647be44139d27aacd82dbec6242bcd3bab43

    Score
    10/10
    remcosratspyware

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks