Extracted

• • Target

    e8dfdb915a523a09e139aaa900991ddd.bat

  • Size

    498B

  • MD5

    e8dfdb915a523a09e139aaa900991ddd

  • SHA1

    d23f4798c549bfb7ddd968c4c2a971f67468a662

  • SHA256

    91619737b3f7af4623dc62b4f3df7b551337ec94f693a3b9ba35bb231483393e

  • SHA512

    b4e737d1c80420688bf856df02a580b691d120307b7d31ea4766448ccd0c6eec7b2c48424691e92dffba58ca8c9a8df989f5b683d9363cac37d3dd3e5ad1623e

  Score

  10^/10

  executionremcos2024discoveryrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2