Extracted

Extracted

• • Target
    CMH.hta
  • Size 14KB
  • SHA256 b3369ab4a219b27a5e7ce7012076ff4955a1074ad76aae0844228cd3d2317cd0
  • MD5 33d064237acbbb0c54afdc4106f53118
  • SHA1 ca222346adb82862957f42ecf6268781e29fa7fb
  • SHA512 5bcaf8c23a66d5ac52da8969496cda653ba64a3fe0ba71e0b36310e0dcb0d3b63d23982352c5c02b842f672ecf9dd913d3eeb571fa0da4e011f97b398609294c
  • SSDEEP 48:3bWzrj4U6/2zrj4KU6/WSsPSwhTsjklWk06SuuuuuuScmrzrjrZzrjF+U6/Tzrjc:r5U6/NKU6/4SwFH0mcmeU6/N+
  • TLSH
    T1536233B85FA1E8DCC283E1A205C6AA171DC09F0FF2634528B49C19E3037926C5D1C79F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  port$$collectiondefense_evasiondiscoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2