Extracted

• • Target
    install-windows-update-to-play-voicemail.vbs
  • Size 7.2MB
  • SHA256 2ea2157403e23b6607fc317c4136ac1c0292f2876f8dfac6fdce2cb1138ba228
  • MD5 b6d0443ccad48e690d190b3665e3b475
  • SHA1 7e702c656017612936994da9fe3bebdd28d4ba17
  • SHA512 be1f25829b1bd85f885abd4d6884909aa6bd68a137791fbe3d0e2a16f7d64ee39328a8604935d00e340a0a6c1a1349a220521a265cea3649871ca36c639758a8
  • SSDEEP 49152:fqcafxoWcoPiVMfRrvFqLya/A4TRayn+1JIc+VJV/Lwz/6yZzPUL03QFAMHLlDww:x
  • TLSH
    T1B176E1334603BCEE3B7D2D84D4002E510C2C2EE797648A59FB8835B7A5E9594CF6E5B8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorremotehostdefense_evasiondiscoveryexecutionremcospersistenceprivilege_escalationransomwareratrevoked_codesignsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2