Extracted

• • Target
    file.exe
  • Size 516KB
  • SHA256 4e11fd9ebcd710646c1c685691837f3e2d4983e9232279ece12a6db9be569ba1
  • MD5 b60c1b642765e2156730e910dbbed55a
  • SHA1 e0bc18e19d753f1a09611416c8fea46d3453aac7
  • SHA512 f9bca6ca4cf5f5f06faf58afa65e16897eabe40f981508d6225880d94a629675c834159a31cfaad28bf04003b949d8b054e5b8194b1211f8dc9cdfb9274f21d2
  • SSDEEP 12288:7813Q9hg+AKfsc/5a+NCGO1UA/DEkINz3WSV/:78lQ96+YcAvwygNz31
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionremcosrem_doc2collectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $WINDIR/compromis/overcheaply.Dum
  • Size 54KB
  • SHA256 e3916adcdcff1f166a6bcd0487b2d725131d275190459841dcd77d869e8f707a
  • MD5 5700ab6572287746a87ecdba691baf79
  • SHA1 5885062f3e65fe332bcf2077bc25323139e60b18
  • SHA512 7a95bb5aee211653b556da9416709d418c77600c561ed7b5af11b559d5052170b2c93ef8e1c70e14536da01b6ac050f5feba81d04784f232cf54ad92db70b106
  • SSDEEP 1536:wdIUK0a2UebWv67ZY3xMxevI7EtHVO3ojPoTtnVnkC:wdIU1Edv67G3x2XEtH03SPytZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4