Extracted

• • Target
    wegivenebstthingswithbetterplaces.hta
  • Size 460KB
  • SHA256 96c269e79deb7ac0f3d52852d5f6cf76a101b2f3bd627b8deb8f8141fb7960c7
  • MD5 41f7a54cfedbb97dd42d7f4002017c73
  • SHA1 c63baa6c0f0d840234434478f058df801d92fb99
  • SHA512 c63b2d46ace7feeead3067a10851c3958c1b2fe93f0b62008f30846dd3747dddd62bd287c0490872c4498c5c499554f0c02d33d62a34440a22b5393be065a0ec
  • SSDEEP 768:lvZvPF5vZvcQPvPFzv8v8vSvXvVvhF3vhF7vthvuvhF3veQPvcQPvcQPvbvtlvhg:df00Z2
  • TLSH
    T127A4763FABEFA285E8AF99C78C01551D93D8101EA47E02A8306545F49CB118977FEFB4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  mxm-mxncollectioncredential_accessdiscoveryexecutionremcosratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2