General
- Target 21072026_0849_Amiantit_RFQ_Documents-BOQ.lnk.zip
- Size 3.2MB
- Sample260721-kq2pksbs8l
- SHA256 3ece0349ff1491f40f197bb85a516753e7922fc9a72b6705f2da78e961f7dbed
Malware Config
Targets
-
- Target Amiantit_RFQ_Documents/BOQ.lnk
- Size 1KB
- SHA256 5fb44b1f830a3c21b2e12287d79a79d60f9dfd3ad33c5a94e946078548a10c1d
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target Amiantit_RFQ_Documents/DRAWINGS.JS
- Size 4.5MB
- SHA256 8959481382543edd72ccf80ebde2249ea0fc79c44a52a95fd1be6b19135174b3
Score10/10-
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suricata alert: REMCOS RAT Malware Inbound C2 Communication
Network activity triggered a Suricata alert
-
Suricata alert: REMCOS RAT Malware Outbound C2 Communication
Network activity triggered a Suricata alert
-
UAC bypass
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Deobfuscate/Decode Files or Information
Payload decoded via CertUtil.
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target Amiantit_RFQ_Documents/SPECIFICATIONS/Amiantit_Request_For_Quotation_for_Ongoing_Project_with_El_Sewedy_Co_in_Rabigh_GV.exe
- Size 499KB
- SHA256 d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Deobfuscate/Decode Files or Information
1Impair Defenses
1Disable or Modify Tools
1Modify Authentication Process
1Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1