Extracted

Extracted

Extracted

• • Target

    Quotation request YN2024-10-07pdf.vbs

  • Size

    543KB

  • MD5

    3d8cf5dfe51b68c3ad7e205faf69eee2

  • SHA1

    036713fc8f92ad3108fdd7851f7c0658c615f091

  • SHA256

    a8d4c91b369fdea22a07354ee6da98dca280e3978faf60943fbadf837ffdc53a

  • SHA512

    9f1f1d1a3e79ed09cab483c657cddaefb079ceb351a34eeee9b008dc892629e9ffaf0999db586d64f1637213ad21b208d6321985281905fe7151b1e769a7b6a3

  • SSDEEP

    1536:ZJJJJJJJJJJJJJJJJJ7ssssssssssssssssssssssssssssssssssssssssssss9:J

  Score

  10^/10

  executionremcosmanifestationscollectiondefense_evasiondiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2