Managed XDR

original-2024-03-26t155744.435.eml (Remcos) — malware analysis report

File info

Filename
original-2024-03-26t155744.435.eml
File type
SMTP mail, ASCII text, with very long lines, with CRLF line terminators
File size
53.8 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
0f1ff6073575f0d77a7eb9c62d6eb71ee037a163
SHA256
a8a6dc5a1dc4dbec286c9b4f2e037a251f9406c898972e5093f62af2cad60a07
MD5
8eccf3aacd7a9aae738dc964ca9e577a

Malwares

  • Remcos

Signatures

Initial Access

T1192 html_urls: HTML-document downloads a file

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1070.004 deletes_self: Moves to different location or removes the original executable file
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1562 dep_disable: Disables DEP
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1070 stealth_window: A process created a hidden window

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.003 antisandbox_sleep: The process attempted to slow down analysis

Command and Control

T1071.001 network_cnc_http: Suspicious HTTP traffic
T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_openurl: Performs HTTP/HTTPS-requests using InternetOpenUrl

Other

yara_rules: Static rules
networkdyndns_checkip: Connects to a Dynamic DNS domain
creates_exe: Creates executable files in the file system
no_graphical_activity: No graphic activity
create_rpc_bindings: Creates RPC connection
origin_langid: Unconventional language of the executable file
get_policy_info: Retrieves information about a Policy object
checktokenmembership: Checks user token with CheckTokenMembership call

Related reports