Extracted

• • Target
    Order 2736.exe
  • Size 375KB
  • SHA256 99d592000e85eef794a714fa042815a31a1d34bba194555bcfc2e85175a8ab2c
  • MD5 db8f4d4fb8ae576974bc62a6b0773971
  • SHA1 7f8694f79fc18dde97a9080e23439b56ad4bcb01
  • SHA512 abae9e7046a46d91930f5389a0c57a12da2d4a9a609cb17c76c5a3fa8f089e8fd367fdaf465fa8a910879a83528589d4e1944478777f05c08069f072ac81967e
  • SSDEEP 6144:bspNjlsn8OLszqA0vgZ7+NIo5zWy7avkBg+WQt7ekmvoZd3iSeWLBqBbTgf3UuXJ:bcE8OLszQvQSIo5Ky7pB5WQt+voeNeqG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remotehostcollectiondiscoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
  • MD5 42b064366f780c1f298fa3cb3aeae260
  • SHA1 5b0349db73c43f35227b252b9aa6555f5ede9015
  • SHA512 50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7
  • SSDEEP 192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6