General
-
Target
QUOTATION 114317.exe
-
Size
1.6MB
-
Sample
210118-gb8vlzm5aj
-
MD5
9ab843b4c2b4edc48edee828a2869c2f
-
SHA1
1b59b91da56ea773bd54ffb10844b58ca9e1de37
-
SHA256
4327efeb833e3daa98a5f1cac94fa6d1c858fd25fb0c416f0880d142a62955a5
-
SHA512
7504b57656fdaf867e1e5a9ed3d93dcb0cfc2d02de96d1725b37f57aa43c3ff3e4d8efdb5646ffe03d62a0d85ba35d10cc0923171b4b4a0bc1eb4352710fe85a
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION 114317.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
QUOTATION 114317.exe
Resource
win10v20201028
Malware Config
Extracted
remcos
eileenwmsscm.duckdns.org:2558
Targets
-
-
Target
QUOTATION 114317.exe
-
Size
1.6MB
-
MD5
9ab843b4c2b4edc48edee828a2869c2f
-
SHA1
1b59b91da56ea773bd54ffb10844b58ca9e1de37
-
SHA256
4327efeb833e3daa98a5f1cac94fa6d1c858fd25fb0c416f0880d142a62955a5
-
SHA512
7504b57656fdaf867e1e5a9ed3d93dcb0cfc2d02de96d1725b37f57aa43c3ff3e4d8efdb5646ffe03d62a0d85ba35d10cc0923171b4b4a0bc1eb4352710fe85a
Score10/10-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-