Extracted

• • Target
    Quote#SO2021010197.pdf.exe
  • Size 1.5MB
  • SHA256 5705f860865c9fd9eb6a5609d3ea183b201e72fa45db0b06be00a4a6f665f82a
  • MD5 104064d4c0b681c9a7ae1f0c00fbff49
  • SHA1 af273bc182f0c492520811da54165534dcf89967
  • SHA512 2e3f19c02580d678c1726b6840cf4e31c1abe5d393f7ca773a934a7ecf2bff1fdc055c60a5b4eec99338a72641aa20c7fbd5e1ad78ec6b29e72ea55fa381b225
  • MD5 SHA1 SHA512

  Score

  10^/10

  remcospersistenceransomwarerat

  • Modifies WinLogon for persistence

    persistence

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2