Extracted

• • Target

    narudžbenica TISAKOMERC d.o.oRadbrkkedes234525262623.wsf

  • Size

    14KB

  • MD5

    00ac87a7b7f4c47f372f933a0591f5a0

  • SHA1

    7b598b1d68948d6a592d4bd28b7c8b1797705554

  • SHA256

    42459d2d84eff34c05f1dd8bdccd7c968606eefd5773bd8fa442cb2a053b3fa0

  • SHA512

    e2df538514eb5f1c76ad018ccc13a37f08667c337d2eed22669d11bdf8c83e75f72eb9f477e4264208606d65d2dd36f658f5982dd7d5f29c9c08232d207a125b

  • SSDEEP

    384:ULqtQwkekctuEedeD42r2TT8FVB+4CpGH:UqtQI2j8G8F33Cpw

  Score

  10^/10

  remcosremotehostcollectiondiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2