Extracted

• • Target
    transaction report.exe
  • Size 267KB
  • SHA256 bfd37bd93dd704927aa58505d0d8215b2e1dd8dc6e69cde508531f1df6cf2d17
  • MD5 ca548c25b30ed6b6ed3a53ba26abb244
  • SHA1 d4c9c3707e2634ed5f995667892e091e58726392
  • SHA512 4779b6212464c4def91ff28d5635ba2c07af17165c4a7763f66c8c029298b9c4fb299208d3470c7423543e303b64228f6c0fd6ddf88bf6d289b2de85e06ef739
  • SSDEEP 6144:VqjIcRumlc/yvGdj3FEfOZLJBpeGt6eoOH/1W1Rvw1oKd7:cVRuMcKvGd3FoWBpPt6eoOH/1W0o67
  • TLSH
    T1844412A7F1A0C503D3765132103F56BE97EAEA0310625FCF63D046AFF925B62852F962
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryremcosinstallerpersistenceratcollection

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
  • MD5 fccff8cb7a1067e23fd2e2b63971a8e1
  • SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
  • SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
  • SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
  • TLSH
    T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4