Extracted

• • Target

    bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a.hta

  • Size

    3KB

  • MD5

    ece58ed90bef5251133c688f6afe915f

  • SHA1

    0b56d72ecb891950f8b4e8bf7288aee0ac102101

  • SHA256

    bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a

  • SHA512

    6bfc48dcfe02152939914c90677854a3292e83beea95573d427d31f76e4deba29e867e9c18719442c1dac19013b5da885f906c78f33a9d4c0d244287927032ad

  Score

  10^/10

  discoveryexecutionremcos2024rat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2