Extracted

• • Target

    brt_1_0147.doc.lnk

  • Size

    47KB

  • MD5

    8b3dc64090b0b26eda4f1195f493160d

  • SHA1

    bd0b4c1d9e8b84465714287727ba5293f9a8eb61

  • SHA256

    cb43e05491b09d4c7da14d3f42d11a2bb4fa81b0fb47717d44c75426832cdf30

  • SHA512

    ddbe1ad300d613531b6ffcb9a8ff607b1e6e7cf676ce738c31d138e6154ff0ee3c1b8d4d8b67c8fec5da444c845b62475736c228eb89d3b013a3ddcb15365deb

  • SSDEEP

    48:88muavUQSbXTo87Cj3YMEDo/FoZaxCogDDo/LX7LdCZZGXu/dZZIa7x:88y8Nkgm3hX+UxCgLX7BuqQ

  Score

  10^/10

  remcosfeetfuckdiscoverylateral_movementpersistenceprivilege_escalationrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Modifies RDP port number used by Windows

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Remote Services: SMB/Windows Admin Shares

    Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

    lateral_movement

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1