remcos | f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5

General

Target

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
Size

634KB
MD5

7855913ebd31fac9f23061b6667c2e76
SHA1

de2b4ec192f57d6c308551f1b71b24fabffb1123
SHA256

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5
SHA512

26d510d6372259f0a59ee6b2224b8e7de25a029978faf4008c46041afdb184ba0e8577baeac321db9a76cdb948246ec140f7dcaa988b99033009f4d371d58d7c

Score

10^/10

remcos wechatsetup evasion persistence rat

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

WeChatsetup

C2

grace.adds-only.xyz:1619

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
WeChatsetup.exe
copy_folder
WeChatx
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
WeChatxl
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-2DS55H
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
WeChatx
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 3 IoCs

Processes:

WeChatsetup.exeWeChatsetup.exeWeChatsetup.exe

pid process

3084 WeChatsetup.exe
1424 WeChatsetup.exe
2576 WeChatsetup.exe
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

pid	process
3084	WeChatsetup.exe
1424	WeChatsetup.exe
2576	WeChatsetup.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WeChatsetup.exef65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WeChatsetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WeChatsetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exeWeChatsetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WeChatx = "\"C:\\Users\\Admin\\AppData\\Roaming\\WeChatx\\WeChatsetup.exe\""	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WeChatsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WeChatx = "\"C:\\Users\\Admin\\AppData\\Roaming\\WeChatx\\WeChatsetup.exe\""	WeChatsetup.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exeWeChatsetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	WeChatsetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	WeChatsetup.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exeWeChatsetup.exe

description	pid	process	target process
PID 2468 set thread context of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 3084 set thread context of 2576	3084	WeChatsetup.exe	WeChatsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3592 schtasks.exe
1260 schtasks.exe

pid	process
3592	schtasks.exe
1260	schtasks.exe

Modifies registry class 1 IoCs

Processes:

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exepowershell.exeWeChatsetup.exepowershell.exe

pid	process
2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
612	powershell.exe
2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
612	powershell.exe
612	powershell.exe
3084	WeChatsetup.exe
3084	WeChatsetup.exe
3084	WeChatsetup.exe
3420	powershell.exe
3084	WeChatsetup.exe
3420	powershell.exe
3420	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exepowershell.exeWeChatsetup.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	3084	WeChatsetup.exe
Token: SeDebugPrivilege	3420	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exeWeChatsetup.exeWeChatsetup.exe

pid	process
2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
3084	WeChatsetup.exe
3084	WeChatsetup.exe
2576	WeChatsetup.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exef65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exeWScript.execmd.exeWeChatsetup.exe

description	pid	process	target process
PID 2468 wrote to memory of 612	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	powershell.exe
PID 2468 wrote to memory of 612	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	powershell.exe
PID 2468 wrote to memory of 612	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	powershell.exe
PID 2468 wrote to memory of 3592	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	schtasks.exe
PID 2468 wrote to memory of 3592	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	schtasks.exe
PID 2468 wrote to memory of 3592	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	schtasks.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2468 wrote to memory of 2772	2468	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
PID 2772 wrote to memory of 2980	2772	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	WScript.exe
PID 2772 wrote to memory of 2980	2772	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	WScript.exe
PID 2772 wrote to memory of 2980	2772	f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe	WScript.exe
PID 2980 wrote to memory of 3264	2980	WScript.exe	cmd.exe
PID 2980 wrote to memory of 3264	2980	WScript.exe	cmd.exe
PID 2980 wrote to memory of 3264	2980	WScript.exe	cmd.exe
PID 3264 wrote to memory of 3084	3264	cmd.exe	WeChatsetup.exe
PID 3264 wrote to memory of 3084	3264	cmd.exe	WeChatsetup.exe
PID 3264 wrote to memory of 3084	3264	cmd.exe	WeChatsetup.exe
PID 3084 wrote to memory of 3420	3084	WeChatsetup.exe	powershell.exe
PID 3084 wrote to memory of 3420	3084	WeChatsetup.exe	powershell.exe
PID 3084 wrote to memory of 3420	3084	WeChatsetup.exe	powershell.exe
PID 3084 wrote to memory of 1260	3084	WeChatsetup.exe	schtasks.exe
PID 3084 wrote to memory of 1260	3084	WeChatsetup.exe	schtasks.exe
PID 3084 wrote to memory of 1260	3084	WeChatsetup.exe	schtasks.exe
PID 3084 wrote to memory of 1424	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 1424	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 1424	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe
PID 3084 wrote to memory of 2576	3084	WeChatsetup.exe	WeChatsetup.exe

C:\Users\Admin\AppData\Local\Temp\f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
"C:\Users\Admin\AppData\Local\Temp\f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:612

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NUrruv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp63A8.tmp"
2⤵
- Creates scheduled task(s)
PID:3592

C:\Users\Admin\AppData\Local\Temp\f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe
"C:\Users\Admin\AppData\Local\Temp\f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5.exe"
2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:3264

C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe
C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NUrruv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE376.tmp"
6⤵
- Creates scheduled task(s)
PID:1260

C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe
"C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe"
6⤵
- Executes dropped EXE
PID:1424

C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe
"C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
d876abe345578d5217712c4134d23e21

SHA1
9a3155b13153e1f5703344ba17bc37aa62edc427

SHA256
9bb6219a276b9e855ea271d5181aebe0e845aeb5cd2cc8028c9d1bb97914c286

SHA512
ac6804989b0c9443c27bf3714da0195447acdd4c98a8241aedf2d0e09bdb5c842a71eff8bce930073dbc477e2058a7f10a0a45331c5935e0fa65286bc8b8f36f

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
cd993335674b29ee5d504bfdd6fceaf4

SHA1
0d9fbb54cdb0802f0adef4cda0e72868234ec0fa

SHA256
177d8acb4ebf8382a98e2ef6a61ca5453774365b783b341a581646a1876e212e

SHA512
3f432b6eb8c35333017ba458fa92ee65cb8aa0c52113505a6dd21d435621b04c3ae708db879f55768593852a9e17c51cf2230642c3d101859008d43eb7cba64c

Download Submit
C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe
MD5
7855913ebd31fac9f23061b6667c2e76

SHA1
de2b4ec192f57d6c308551f1b71b24fabffb1123

SHA256
f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5

SHA512
26d510d6372259f0a59ee6b2224b8e7de25a029978faf4008c46041afdb184ba0e8577baeac321db9a76cdb948246ec140f7dcaa988b99033009f4d371d58d7c

Download Submit
C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe
MD5
7855913ebd31fac9f23061b6667c2e76

SHA1
de2b4ec192f57d6c308551f1b71b24fabffb1123

SHA256
f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5

SHA512
26d510d6372259f0a59ee6b2224b8e7de25a029978faf4008c46041afdb184ba0e8577baeac321db9a76cdb948246ec140f7dcaa988b99033009f4d371d58d7c

Download Submit
C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe
MD5
7855913ebd31fac9f23061b6667c2e76

SHA1
de2b4ec192f57d6c308551f1b71b24fabffb1123

SHA256
f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5

SHA512
26d510d6372259f0a59ee6b2224b8e7de25a029978faf4008c46041afdb184ba0e8577baeac321db9a76cdb948246ec140f7dcaa988b99033009f4d371d58d7c

Download Submit
C:\Users\Admin\AppData\Roaming\WeChatx\WeChatsetup.exe
MD5
7855913ebd31fac9f23061b6667c2e76

SHA1
de2b4ec192f57d6c308551f1b71b24fabffb1123

SHA256
f65991084f00783d95ebf9db672ca60c2d734c9131e8bfd98fae6040b936fbd5

SHA512
26d510d6372259f0a59ee6b2224b8e7de25a029978faf4008c46041afdb184ba0e8577baeac321db9a76cdb948246ec140f7dcaa988b99033009f4d371d58d7c

Download Submit
memory/612-146-0x0000000008140000-0x0000000008141000-memory.dmp

Filesize
4KB

Download
memory/612-185-0x0000000004743000-0x0000000004744000-memory.dmp

Filesize
4KB

Download
memory/612-153-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/612-126-0x0000000000000000-mapping.dmp

Download
memory/612-184-0x000000007F840000-0x000000007F841000-memory.dmp

Filesize
4KB

Download
memory/612-128-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/612-129-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/612-130-0x0000000004600000-0x0000000004601000-memory.dmp

Filesize
4KB

Download
memory/612-131-0x0000000007140000-0x0000000007141000-memory.dmp

Filesize
4KB

Download
memory/612-132-0x0000000007060000-0x0000000007061000-memory.dmp

Filesize
4KB

Download
memory/612-133-0x0000000007770000-0x0000000007771000-memory.dmp

Filesize
4KB

Download
memory/612-144-0x0000000004742000-0x0000000004743000-memory.dmp

Filesize
4KB

Download
memory/612-177-0x0000000009420000-0x0000000009421000-memory.dmp

Filesize
4KB

Download
memory/612-137-0x0000000007A30000-0x0000000007A31000-memory.dmp

Filesize
4KB

Download
memory/612-176-0x0000000009200000-0x0000000009201000-memory.dmp

Filesize
4KB

Download
memory/612-171-0x00000000090B0000-0x00000000090B1000-memory.dmp

Filesize
4KB

Download
memory/612-164-0x00000000090D0000-0x0000000009103000-memory.dmp

Filesize
204KB

Download
memory/612-141-0x0000000007E00000-0x0000000007E01000-memory.dmp

Filesize
4KB

Download
memory/612-142-0x0000000008300000-0x0000000008301000-memory.dmp

Filesize
4KB

Download
memory/612-143-0x0000000004740000-0x0000000004741000-memory.dmp

Filesize
4KB

Download
memory/1260-405-0x0000000000000000-mapping.dmp

Download
memory/2468-122-0x0000000004DB0000-0x00000000052AE000-memory.dmp

Filesize
5.0MB

Download
memory/2468-127-0x000000000AA70000-0x000000000AA71000-memory.dmp

Filesize
4KB

Download
memory/2468-117-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/2468-118-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/2468-124-0x0000000009240000-0x0000000009241000-memory.dmp

Filesize
4KB

Download
memory/2468-121-0x0000000004DB0000-0x00000000052AE000-memory.dmp

Filesize
5.0MB

Download
memory/2468-119-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/2468-123-0x0000000009180000-0x0000000009188000-memory.dmp

Filesize
32KB

Download
memory/2468-115-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/2468-125-0x0000000009420000-0x00000000094B5000-memory.dmp

Filesize
596KB

Download
memory/2468-120-0x0000000004DB0000-0x00000000052AE000-memory.dmp

Filesize
5.0MB

Download
memory/2576-408-0x000000000042FC39-mapping.dmp

Download
memory/2576-419-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2772-136-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2772-138-0x000000000042FC39-mapping.dmp

Download
memory/2772-145-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2980-139-0x0000000000000000-mapping.dmp

Download
memory/3084-180-0x00000000048B0000-0x0000000004DAE000-memory.dmp

Filesize
5.0MB

Download
memory/3084-181-0x00000000048B0000-0x0000000004DAE000-memory.dmp

Filesize
5.0MB

Download
memory/3084-182-0x00000000048B0000-0x0000000004DAE000-memory.dmp

Filesize
5.0MB

Download
memory/3084-148-0x0000000000000000-mapping.dmp

Download
memory/3264-147-0x0000000000000000-mapping.dmp

Download
memory/3420-398-0x0000000000000000-mapping.dmp

Download
memory/3420-417-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/3420-418-0x0000000000DF2000-0x0000000000DF3000-memory.dmp

Filesize
4KB

Download
memory/3420-442-0x0000000000DF3000-0x0000000000DF4000-memory.dmp

Filesize
4KB

Download
memory/3420-441-0x000000007F3F0000-0x000000007F3F1000-memory.dmp

Filesize
4KB

Download
memory/3592-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads