Extracted

• • Target

    9eb3ac05340da70c56dc36e8beece9a7c052c945fc3ceade2c622c4defec54b3.xlsx

  • Size

    1.3MB

  • MD5

    777464f57cb83a39b7324d1f7505b6d6

  • SHA1

    25acb95ef77574c20002165e6b68526d7318acd1

  • SHA256

    9eb3ac05340da70c56dc36e8beece9a7c052c945fc3ceade2c622c4defec54b3

  • SHA512

    6609bfa04a5ae724eabd2f13c992a255554ae910ce6bcd6d25a62d8e2652d8aa129eae0908e266e3dfa808c19708a0a45c9b2922c531e03b1c2142847dbab8e3

  • SSDEEP

    24576:pVH9M2HUO8Yfb3B/RvUp9EKDE/XY6lRvmfOdkGRjXv4cGysQYcb06hp8IJh1:LdMj/cb3I6Kg/ooofOdkGRXQcGTlczD

  Score

  10^/10

  remcoszynovadefense_evasiondiscoveryexecutionrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2