Extracted

• • Target

    9f71dfb4c82b046b86940ff82f86cadf.hta

  • Size

    115KB

  • MD5

    9f71dfb4c82b046b86940ff82f86cadf

  • SHA1

    6bcd13d4f0e0ebf49b1107cd120368230effd547

  • SHA256

    3dab14859030e20708a39df701feb49b3b33097a3b1178d1801be40746c43232

  • SHA512

    bd64fe93e298261840995ba2a1f46418ffcc87875682d1ee921063c0e3911ad407efd086c96a7ee4643a673b6b678aab2aa89d8d90ec76d4ae7b21cd3a2686ba

  • SSDEEP

    48:7oa+apd7Ah23jBZ9mqYZ9NqZ4v0te2RVC1c8oawopyZAqXl9RXGbZ9nZ9GZkBUyN:Ea+M77929kRVTTwcnlXu9Z9K9s8AT

  Score

  10^/10

  remcosremotehostcollectiondefense_evasiondiscoveryexecutionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2