Extracted

• • Target

    FDD-12164 - Ref. no. FPSD-46945.docx

  • Size

    1.7MB

  • MD5

    58d7b56383c39df07322fef108a8b0f6

  • SHA1

    5b0731eb50b808a990174d1e38cdf29854d52856

  • SHA256

    f236ecc5c743637f451083feddf683834e3725abffac09a60adb686348b21558

  • SHA512

    ccbc3233ba093471568eae8e6559dff14055a9a427a60355a1159a2f6daf06f8363a8990388e51bc1ec611857ea0ec2079c8800ef5c96529e76a09c6f5dc96df

  • SSDEEP

    49152:pX7vgOtGReTU5wFk2M296HnvYk3oV4fSPyfuy0oh/:R7I6GVH2M1ngqoVry0M/

  Score

  10^/10

  remcosgenerallpersistencerat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2