Extracted

• • Target
    RFQ-MVP300-3400.doc
  • Size 73KB
  • SHA256 eb7cabca916e8bf7e7cfc0bae4d7569987a6516796dd7f6f9e6fe93c519dad62
  • MD5 b9fa8f1bf3cfb74acc2c5f58b67058b8
  • SHA1 79d42f688c7ff089585c07994bd6396d948602cb
  • SHA512 d1ca0115a374618a2e73b1c04d7c046b32af950688c4041c35623923c6d51c41404c7b23ebb62b7d1d777118df614943d7f279ee0e8e5d58aea86e3a97a6bd7e
  • SSDEEP 1536:TsCXf9SEqrr+j7WzWdCBfudtZnZJcn3bsWkC3b1L49wGk86JzC52p0cwvd3jo0Vu:oCXlnirj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostpersistencerat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2