General
- Target SEC Purchase Order PO Emirates National Oil Company (ENOC) Project.zip
- Size 817KB
- Sample261027-m59pvadv3q
- SHA256 322b26baff367a651158c530ff28f63c5e80da826f48e7450592db1dde579b1b
Score
10/10
Malware Config
Targets
-
- Target SEC Purchase Order PO Emirates National Oil Company (ENOC) Project.MSI
- Size 844KB
- SHA256 75d5856ce2ba9e3f53a5bec4cc812204196243c843665946345d240bf2eb3442
Score10/10Family: Remcos
Remcos is a closed-source remote control and surveillance software.
Suricata alert: REMCOS RAT Malware Inbound C2 Communication
Network activity triggered a Suricata alert
Suricata alert: REMCOS RAT Malware Outbound C2 Communication
Network activity triggered a Suricata alert
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook profiles
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1