Remcos RAT New TTPS – Detection & Response - Security Investigation
Tags
Common Information
| Type | Value |
|---|---|
| UUID | f4b24921-e0fc-490c-8074-2a9c5f9a2f06 |
| Fingerprint | 5882037cedf24299 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Aug. 29, 2022, 3:18 p.m. |
| Added to db | Sept. 11, 2022, 12:44 p.m. |
| Last updated | Nov. 17, 2024, 6:54 p.m. |
| Headline | Remcos RAT New TTPS – Detection & Response |
| Title | Remcos RAT New TTPS – Detection & Response - Security Investigation |
| Detected Hints/Tags/Attributes | 34/2/32 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://www.socinvestigation.com/remcos-rat-new-ttps-detection-response/ |
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 285 | microsoft.net |
|
| Details | Domain | 12 | geoplugin.net |
|
| Details | Domain | 7 | json.gp |
|
| Details | Domain | 1 | falimore001.hopto.org |
|
| Details | Domain | 4 | reference.id |
|
| Details | File | 2 | sctasks.exe |
|
| Details | File | 70 | vbc.exe |
|
| Details | File | 10 | easinvoker.exe |
|
| Details | File | 249 | schtasks.exe |
|
| Details | File | 12 | netutils.dll |
|
| Details | File | 2 | '%.iso |
|
| Details | File | 1 | '%.exe |
|
| Details | File | 1 | '%vbc.exe |
|
| Details | File | 1 | '%schtasks.exe |
|
| Details | File | 1 | sinvoker.exe |
|
| Details | File | 1 | '%netutils.dll |
|
| Details | File | 3 | event_data.obj |
|
| Details | File | 2 | targetfilename.key |
|
| Details | File | 1 | objectname.key |
|
| Details | File | 7 | commandline.key |
|
| Details | File | 2 | '.iso |
|
| Details | File | 23 | '.exe |
|
| Details | File | 1 | 'vbc.exe |
|
| Details | File | 3 | 'schtasks.exe |
|
| Details | File | 3 | 'easinvoker.exe |
|
| Details | File | 3 | 'netutils.dll |
|
| Details | md5 | 1 | 6d25e04e66cccb61648f34728af7c2f2 |
|
| Details | md5 | 1 | F331c18c3f685d245d40911d3bd20519 |
|
| Details | md5 | 1 | 8cea687c5c02c9b71303c53dc2641f03 |
|
| Details | IPv4 | 7 | 178.237.33.50 |
|
| Details | IPv4 | 1 | 194.147.140.29 |
|
| Details | Url | 4 | http://geoplugin.net/json.gp |