General
-
Target
EFT_PAYMENT_ADVICE_221508.xls
-
Size
237KB
-
Sample
220816-aa2pjacbe4
-
MD5
ad086186038063d4edf7f44293e4076c
-
SHA1
04310c2777ab06987c0890e61cccc00ea5e9dc00
-
SHA256
c8731e32018fec3b2bd3074a5c2f97ddf4da559cf2fe039d2e3d5b8155092d31
-
SHA512
0ed637740820c84ba5db60272b058374b0b558f305be1ca81c93a52f3c5c35b07f47ad03e461d0a1fd38f96025deee144ffc3de584b9bc1800126969d86e99e2
Behavioral task
behavioral1
Sample
EFT_PAYMENT_ADVICE_221508.xls
Resource
win7-20220812-en
Malware Config
Extracted
remcos
Aug
topboysully.dvrlists.com:10171
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Aug-MR3KZU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
EFT_PAYMENT_ADVICE_221508.xls
-
Size
237KB
-
MD5
ad086186038063d4edf7f44293e4076c
-
SHA1
04310c2777ab06987c0890e61cccc00ea5e9dc00
-
SHA256
c8731e32018fec3b2bd3074a5c2f97ddf4da559cf2fe039d2e3d5b8155092d31
-
SHA512
0ed637740820c84ba5db60272b058374b0b558f305be1ca81c93a52f3c5c35b07f47ad03e461d0a1fd38f96025deee144ffc3de584b9bc1800126969d86e99e2
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-