Extracted

• • Target
    Order-R-25060.xlsm
  • Size 4.0MB
  • SHA256 6e6848ee2825bb98d2554ce3ccab87761c4f1fc052e8a65b3415d060966d565d
  • MD5 5ab08f7b57dc8713f25135eb6c19078a
  • SHA1 63d83ff321e72b863768af0cef05c9d65ff3e339
  • SHA512 d60228ccfd06ea57a3c7b5107f0b4a06ca26abbf3084b073dbf1ed4dc5a6097bdb9068d160b036a1fa787414026c7033b2534da2af94f2f5ab09b1986b63b1d5
  • SSDEEP 98304:fa0AtJJ4n7XeXdHmgooQ6KwxQ/NHUlKTeRJ+Ns5YbWQrT2hrC5txRs4W:1A4n7eXzLQ2mtUwTlKYbDf2hrkXRs4W
  • TLSH
    T18616238A0FAE0BE7F1699AB0D741B04165126B524FB782514AF5E73490FBB0E0B7FE50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  tomjicollectiondiscoveryexecutiondonutloaderremcosloaderratspywarestealersuricata

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2