Extracted

• • Target

    Inv 30532.xls

  • Size

    547KB

  • MD5

    560b9bdb75835822ed9f84d46521fd38

  • SHA1

    e68f1783002016aabecfd74ef333b90be19262ac

  • SHA256

    bbfa2653ffb918121ecb6457991267689d3802e2afcbba498f0e3ef0e6740a96

  • SHA512

    55f533cc57c8379de0c5227ccef9e237ad512844dfde30d112b6b86932f9024cae30de0dcd57a12abf8819174e6319ccc2fb4493df773360021e3afd9c49dd83

  • SSDEEP

    12288:WI1GWVjZScJbyWKEVuqg2/6VnDIh7xOP1fJYWe/egIY4Fg3lh:WCrjZsWKElYnvtfw/ed

  Score

  10^/10

  remcosremotehostdefense_evasiondiscoveryevasionexecutionpersistenceratthemidatrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2