Extracted

• • Target

    Smple_Order-048576744759475945.xls

  • Size

    1.1MB

  • MD5

    df946e734bca37e4eaf06978a0b95ef1

  • SHA1

    c06f8ddc7d5cb1030c516286bd0a660502cbbe35

  • SHA256

    7fb0d13c333aef86316da1494da234eade3b8db44fddd27affc38bae40614744

  • SHA512

    e9dd9266c4dc5721b47d1d4de0e1525482cbec8330e5003f0444d940c99380efae89f7424d709e7aac4962e2541d84b06c1fb7d4686e0949a852e83b39d5dc96

  • SSDEEP

    12288:qymzHJEUiOIBUzMTSgD3DERnLRmF8DrEPTxpsAQx1Zj+j+EPebSA5YiA76UdKX/E:4BaRbARM8+D8Z+jJC50YrNPkly4h

  Score

  10^/10

  remcoselvisdefense_evasiondiscoveryexecutionphishingrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2