Extracted

• • Target
    1109118734xlsx.exe
  • Size 1.4MB
  • SHA256 d78beea33ff995cf0269602c7b95e498c1eec4b9be5e70c5b367a4435842db31
  • MD5 6aabda25e2138d1197fa327c1096ea93
  • SHA1 5c46a56f3b2aa3b383b431b223d2f847adcedddb
  • SHA512 130dd9b3b7698ca24a1efb5b5b2202c1d9566201ffe180c1d833e91a1f0b8435ffda193a8bcd80204a245b5aa8922c6d8b1aeaa03e6c5651776df8fccdc53b1e
  • SSDEEP 24576:Kadmu5MNkum/mthprduS9gTC5F4h0zM1ObgZuXiuG9uQ1/Wg2Uw95jcscEb67xsb:pNmyz+/tiTC5Fo0QIG9uk/2/Xjct3s
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
  • MD5 192639861e3dc2dc5c08bb8f8c7260d5
  • SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
  • SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
  • SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
  • MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
  • SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
  • SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
  • SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6