Extracted

• • Target

    0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d.exe

  • Size

    466KB

  • MD5

    23350a33531966fa6a0cf02f9c27f053

  • SHA1

    1f53024c59b6b65fcf032bd5bb69cedbdcc67dfa

  • SHA256

    0d4bf4e1a47fa2cfdb5cdc23d8a2b1552c1d82c307e1eec95297e62a478d2f2d

  • SHA512

    b6f8bbbbc5bf9b4d982bdab369513b5667835aa6660678917c259b599d563c7ad2d8f5233e4c62d962523393d8faa51087e3696fa72cabbde81ec1a39d3adfac

  • SSDEEP

    12288:JuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDS57G+DY:809AfNIEYsunZvZ19ZiGs

  Score

  10^/10

  remcosr2411defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarerattrojan

  • Modifies Windows Defender notification settings

    evasiontrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2