Extracted

• • Target

    CONSOLIDADO DIGITAL DE DEMANDA 12 DE JULIO.exe

  • Size

    1023.9MB

  • MD5

    9780f8e4adc6012e0661b0a343474d40

  • SHA1

    8393243c3327e934e6bccb15141820663d55a7b5

  • SHA256

    45287b1123b46c3de113324bb247c08643e27fa743e253224c5c5a093e5d9181

  • SHA512

    10ec310bd8bcaa3dabbef138dc1b49177d3cd548926d9b7e99d81c54ca7533ff61fe49bf20af03c876ecfc28f506272fb0c6c99aebc01131795ac37fe06a6978

  • SSDEEP

    12288:f2+avXb5PBdKkQuWnOmhIx61axFbOXBR/O+yNUMIvkaW0o:e+MB7RQuO11abbqPMNU3vkn0o

  Score

  10^/10

  remcosmexicodiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies RDP port number used by Windows

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers COM server for autorun

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1