General
-
Target
Req. for quotation.xls
-
Size
307KB
-
Sample
240522-wtvk8abf29
-
MD5
aebf2a5d9c39a0ca3f50c94ef4019ea5
-
SHA1
d13bca09d55ec93ca8d21ec63a5371f60a247aaf
-
SHA256
6a1302ddfc84a73a69702b11ca81d318b073a07f79344c1485c5166e543f4518
-
SHA512
8f684125d385e94a5f1a7b70e9727ccdbc350ce2150f5c70b3de49d33d1195f8c9fba96aeea922eae0b46fd336ae84b2ccd4493a9e4166b6c500bc2072b7119d
-
SSDEEP
6144:u0W8kCSJ2FVYIa5FxCF/LWJ/Z/kM7yaTW7IY3BPdSI9pev+OZoK87:JW8kCSJcKxCAgQyag3BPIjLZoK87
Static task
static1
Behavioral task
behavioral1
Sample
Req. for quotation.xls
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Req. for quotation.xls
Resource
win10v2004-20240426-en
Malware Config
Extracted
remcos
New
hoacanhceramic.com:14782
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-4X155W
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Req. for quotation.xls
-
Size
307KB
-
MD5
aebf2a5d9c39a0ca3f50c94ef4019ea5
-
SHA1
d13bca09d55ec93ca8d21ec63a5371f60a247aaf
-
SHA256
6a1302ddfc84a73a69702b11ca81d318b073a07f79344c1485c5166e543f4518
-
SHA512
8f684125d385e94a5f1a7b70e9727ccdbc350ce2150f5c70b3de49d33d1195f8c9fba96aeea922eae0b46fd336ae84b2ccd4493a9e4166b6c500bc2072b7119d
-
SSDEEP
6144:u0W8kCSJ2FVYIa5FxCF/LWJ/Z/kM7yaTW7IY3BPdSI9pev+OZoK87:JW8kCSJcKxCAgQyag3BPIjLZoK87
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Blocklisted process makes network request
-
Abuses OpenXML format to download file from external location
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-