Extracted

• • Target

    6706e721f2c06.exe

  • Size

    160KB

  • MD5

    9d26cee91cd86b11808a161681be9f85

  • SHA1

    f0334a5e2d01bbaf5bdb4a103bf9504dad218f85

  • SHA256

    c3dee07cba853e66489d883ef5bcc094ea32861828ebfcde773e7527726be35c

  • SHA512

    c18981b4b41faa942159c12a27b8ef6bcf16905b160cbe59b92823b52eabfeb698d1f44614bfc03162926d044681a1be54aa24bd13b3624f05d9c0cd0ee0f3d4

  • SSDEEP

    3072:1ahKyd2n31D5GWp1icKAArDZz4N9GhbkrNEk18HzvT:1ahObp0yN90QEV

  Score

  10^/10

  remcoshost_onediscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1