Overview

overview

10

Static

static

2021 NEW P...T.xlsx

windows7_x64

10

2021 NEW P...T.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2021 NEW PURCHASE REQUIREMENT.xlsx

  • Size

    1.4MB

  • Sample

    210113-dh486kskcj

  • MD5

    c12a39b32626cd2b4ca80d41ffa7a24c

  • SHA1

    2105a2bc2161e9adfa0d3e087e43a466b9f5df58

  • SHA256

    baac57b1f64f5d6e9eeadc84424db056fe253119f0f1bf4b2f2b55f940bce4ab

  • SHA512

    f9a0ed261feea72e6bc128475db4ae5f239ade26937f1b5a645ad5c8d7face344c8ba3a90fbed5679bcd19207e66a52e2cebd5ed210b82d6590eb10a7486ea22

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017

Targets

    • Target

      2021 NEW PURCHASE REQUIREMENT.xlsx

    • Size

      1.4MB

    • MD5

      c12a39b32626cd2b4ca80d41ffa7a24c

    • SHA1

      2105a2bc2161e9adfa0d3e087e43a466b9f5df58

    • SHA256

      baac57b1f64f5d6e9eeadc84424db056fe253119f0f1bf4b2f2b55f940bce4ab

    • SHA512

      f9a0ed261feea72e6bc128475db4ae5f239ade26937f1b5a645ad5c8d7face344c8ba3a90fbed5679bcd19207e66a52e2cebd5ed210b82d6590eb10a7486ea22

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks