Extracted

• • Target

    TT12822024.xls

  • Size

    640KB

  • MD5

    3e23db29ce7cdc215bac52c531aed525

  • SHA1

    57286b0272df8386254ba0fbe340f0fba2cafbc8

  • SHA256

    2fc21f78d38708b2fd7d776780305ae303ec4277e41241462d4cf3f94a779d29

  • SHA512

    0dfe34dcf345a6d501ad6d20758b212f7c13af5181330fcdbad3598a748b155c811438bde78220efd26aa73ffe6273c639fea7d04ed2b7d32f1a58da43195843

  • SSDEEP

    12288:ECf1SLuA5XvOZWQNb7/Aiy/vyEzrFdIiC1smRaAVpwnzI613rQdq:zMxxvXQ5/ny/v9r4PKqczI6NMd

  Score

  10^/10

  remcosremotehostcollectiondefense_evasiondiscoveryexecutionratspywarestealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2