Extracted

• • Target

    INQUIRY#46789-AUG24.exe

  • Size

    961KB

  • MD5

    6739731d73cfc53f4ada4d0b5c406a4d

  • SHA1

    1eccbca184fb95f7b04ad40a489ab4e22bf82015

  • SHA256

    201dce891b1e5559e3126c5fb3fd7eb2c417455c2e4e04f6d613e3f7a12f4dba

  • SHA512

    b62bfbe28745c976bc57719e902a89e89739c22dfb675014d4b817e477a9ce135476da04c5c1af87b4b9d2f189f84a3f7c97ed71c638920f6cdc67a0c15f2bcc

  • SSDEEP

    24576:+KP1msLs5bdXuurDNfGwVy9Q4c3eANIlExWyT:dP1mUsBrRO6sQptNISd

  Score

  10^/10

  remcosclientcollectioncredential_accessdiscoverypersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2