Extracted

• • Target

    file.exe

  • Size

    516KB

  • MD5

    b60c1b642765e2156730e910dbbed55a

  • SHA1

    e0bc18e19d753f1a09611416c8fea46d3453aac7

  • SHA256

    4e11fd9ebcd710646c1c685691837f3e2d4983e9232279ece12a6db9be569ba1

  • SHA512

    f9bca6ca4cf5f5f06faf58afa65e16897eabe40f981508d6225880d94a629675c834159a31cfaad28bf04003b949d8b054e5b8194b1211f8dc9cdfb9274f21d2

  • SSDEEP

    12288:7813Q9hg+AKfsc/5a+NCGO1UA/DEkINz3WSV/:78lQ96+YcAvwygNz31

  Score

  10^/10

  discoveryexecutionremcosrem_doc2collectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $WINDIR/compromis/overcheaply.Dum

  • Size

    54KB

  • MD5

    5700ab6572287746a87ecdba691baf79

  • SHA1

    5885062f3e65fe332bcf2077bc25323139e60b18

  • SHA256

    e3916adcdcff1f166a6bcd0487b2d725131d275190459841dcd77d869e8f707a

  • SHA512

    7a95bb5aee211653b556da9416709d418c77600c561ed7b5af11b559d5052170b2c93ef8e1c70e14536da01b6ac050f5feba81d04784f232cf54ad92db70b106

  • SSDEEP

    1536:wdIUK0a2UebWv67ZY3xMxevI7EtHVO3ojPoTtnVnkC:wdIU1Edv67G3x2XEtH03SPytZ

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4