General
-
Target
0d84935d753e9066e83e9c57e5b4a665338b8dc56c31b429ff77208e07bb2b07
-
Size
2.3MB
-
Sample
240615-xbwk8svcpm
-
MD5
81712e0bc8435df05e8091121bcb94e9
-
SHA1
4822b0e47a0bfeef39812d0a140fa1ce497ba722
-
SHA256
0d84935d753e9066e83e9c57e5b4a665338b8dc56c31b429ff77208e07bb2b07
-
SHA512
a811bce5c38f78f6a37c9095414de08d63357e5bbc48be690312fdbe8221b1a5c85f92975ef44a698ee50f8ed3a2289adf05b3d7b41afb650c05d78e4903d09e
-
SSDEEP
24576:STddvv8bnSYfLT1qVFrj7x+qVwxB+/ULsgfGQkOkl9sxkvqUMekCx:STdx8HAToqVwSKsgfGRsxkvqRekCx
Static task
static1
Behavioral task
behavioral1
Sample
0d84935d753e9066e83e9c57e5b4a665338b8dc56c31b429ff77208e07bb2b07.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0d84935d753e9066e83e9c57e5b4a665338b8dc56c31b429ff77208e07bb2b07.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
remcos
1.7 Pro
Host
blessbebenard21.ddns.net:2404
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
firewall.exe
-
copy_folder
firewall
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%WinDir%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_pvamukqbyy
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
0d84935d753e9066e83e9c57e5b4a665338b8dc56c31b429ff77208e07bb2b07
-
Size
2.3MB
-
MD5
81712e0bc8435df05e8091121bcb94e9
-
SHA1
4822b0e47a0bfeef39812d0a140fa1ce497ba722
-
SHA256
0d84935d753e9066e83e9c57e5b4a665338b8dc56c31b429ff77208e07bb2b07
-
SHA512
a811bce5c38f78f6a37c9095414de08d63357e5bbc48be690312fdbe8221b1a5c85f92975ef44a698ee50f8ed3a2289adf05b3d7b41afb650c05d78e4903d09e
-
SSDEEP
24576:STddvv8bnSYfLT1qVFrj7x+qVwxB+/ULsgfGQkOkl9sxkvqUMekCx:STdx8HAToqVwSKsgfGRsxkvqRekCx
Score10/10-
detects Windows exceutables potentially bypassing UAC using eventvwr.exe
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-