Extracted

• • Target

    TNTinvoice9.26.2024.exe

  • Size

    881KB

  • MD5

    7afd5be4b77090388ddecb8169cf0bc3

  • SHA1

    d3b6ba2e53aed1471c12196c577b7be56d14cf2f

  • SHA256

    68a4b0d743c427d59d076376e5c3a131ee7ab29cdc959b8872735c06b70b7036

  • SHA512

    2f16fce3f75bce88c79286f41010d76691fe0fab37c4fad814867b819c60c81fe4dff17ad722952cc6c7a7d99aaec75d51d2fd16350babb8d3388e11d2236a06

  • SSDEEP

    24576:VE8AE9lxicGLP0CDyB/1FNlUcDos713jb:VExsxiTVe1F/UcDosVb

  Score

  10^/10

  remcosirndiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2