Extracted

• • Target

    EFT PAYMENT ADVICE-CTI09272022.doc

  • Size

    272KB

  • MD5

    e7015ec2d6320c2eb00a304a73c54d1d

  • SHA1

    f7f5dd9cd6d0975d8bae9a5ba460f51f28617cbc

  • SHA256

    a40007a2e46eee90ced835b786774681aabb6c8677ec86b8d999b8ba28439194

  • SHA512

    0dbde3cb93cd0599897fe7490a1373369a8bc42fc3d78a12d2afe18c62e81444f7771ed66e6cd1da959d0510fffae947e01dc1e4469396cedc7f82b7cfa66044

  • SSDEEP

    3072:9XQVvATx74hqpQUtFwGj/Ay0kVTjXLAZyNLPmWstbJU/QRRJKgdE/9Tx9zOswCET:9XAvg4hQfbbACTbyy03tbckRJK5/5Vw

  Score

  10^/10

  remcosseptarat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2