General
-
Target
SOA-0438.xlsx
-
Size
707KB
-
Sample
230608-hnmfrsde8z
-
MD5
261cc699f2de3e15d63c9a9180cb8625
-
SHA1
db971ea8c3b8f0a9a301995b6c3c8523f581d831
-
SHA256
f08bfda687fb0ba2d1e4563a6a7d75958d5ef4a1b7ea61b51c96ddc08202e1ba
-
SHA512
52890f68712fc3602a31ba84f014728bfb362154d4ba0ed19ff9a3aa0fb038b3a1302a8059902117c88db4c36620434947e379ef423674762b527798731dcda1
-
SSDEEP
12288:M/UZf3FotX6dmtGrDDkBB9UFG+ZFQsnRV4hSISDCQ2UYWCQ5BEpMYzKGyOq:MOF+zGoBB9StZ2wvZISDC4Yk0EOq
Static task
static1
Behavioral task
behavioral1
Sample
SOA-0438.xlsx
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SOA-0438.xlsx
Resource
win10v2004-20230220-en
Malware Config
Extracted
remcos
Awelle-Host
gdyhjjdhbvxgsfe.gotdns.ch:2718
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-W62KZF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
SOA-0438.xlsx
-
Size
707KB
-
MD5
261cc699f2de3e15d63c9a9180cb8625
-
SHA1
db971ea8c3b8f0a9a301995b6c3c8523f581d831
-
SHA256
f08bfda687fb0ba2d1e4563a6a7d75958d5ef4a1b7ea61b51c96ddc08202e1ba
-
SHA512
52890f68712fc3602a31ba84f014728bfb362154d4ba0ed19ff9a3aa0fb038b3a1302a8059902117c88db4c36620434947e379ef423674762b527798731dcda1
-
SSDEEP
12288:M/UZf3FotX6dmtGrDDkBB9UFG+ZFQsnRV4hSISDCQ2UYWCQ5BEpMYzKGyOq:MOF+zGoBB9StZ2wvZISDC4Yk0EOq
Score10/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-