Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 06:00
Static task
static1
Behavioral task
behavioral1
Sample
31883190ELECTRICAL.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
31883190ELECTRICAL.exe
Resource
win10v2004-20230220-en
General
-
Target
31883190ELECTRICAL.exe
-
Size
586KB
-
MD5
fe4416331247444c6c57ea58ad78e1ef
-
SHA1
d738112ccfc03f09b5b568e13f34cc02fcd40c73
-
SHA256
ecfc23f618cbfb73fb59ffa9041ef8308eee9cd322c612efcf6e09815eba6851
-
SHA512
3cadbedbe829faf961bba5c06b64f7c494aefc9c18079004b28fdb9f58352e79d041b65846b162789cb651c8a636b413d25101407d966337595dbdc07781cdcb
-
SSDEEP
12288:Vc1TtA2C24kq3x/cxZiDsxJbOcSEcCOkGQUgZLvWAWNCmfsujmZGEQEO:Vk+B24kqF7DsxXLPTXvWHMmUujmTQB
Malware Config
Extracted
remcos
RemoteHost
155.94.136.161:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-EN47F6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2560-163-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/2560-168-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4568-161-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4568-171-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4568-177-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4568-161-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2560-163-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/2560-168-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/4568-171-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/4192-173-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4192-174-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4568-177-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
31883190ELECTRICAL.exe31883190ELECTRICAL.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 31883190ELECTRICAL.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 31883190ELECTRICAL.exe -
Loads dropped DLL 1 IoCs
Processes:
31883190ELECTRICAL.exepid process 3480 31883190ELECTRICAL.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
31883190ELECTRICAL.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 31883190ELECTRICAL.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
31883190ELECTRICAL.exepid process 1748 31883190ELECTRICAL.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
31883190ELECTRICAL.exe31883190ELECTRICAL.exepid process 3480 31883190ELECTRICAL.exe 1748 31883190ELECTRICAL.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
31883190ELECTRICAL.exe31883190ELECTRICAL.exedescription pid process target process PID 3480 set thread context of 1748 3480 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 set thread context of 4568 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 set thread context of 2560 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 set thread context of 4192 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
31883190ELECTRICAL.exe31883190ELECTRICAL.exepid process 4568 31883190ELECTRICAL.exe 4568 31883190ELECTRICAL.exe 4192 31883190ELECTRICAL.exe 4192 31883190ELECTRICAL.exe 4568 31883190ELECTRICAL.exe 4568 31883190ELECTRICAL.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
31883190ELECTRICAL.exe31883190ELECTRICAL.exepid process 3480 31883190ELECTRICAL.exe 1748 31883190ELECTRICAL.exe 1748 31883190ELECTRICAL.exe 1748 31883190ELECTRICAL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
31883190ELECTRICAL.exedescription pid process Token: SeDebugPrivilege 4192 31883190ELECTRICAL.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
31883190ELECTRICAL.exepid process 1748 31883190ELECTRICAL.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
31883190ELECTRICAL.exe31883190ELECTRICAL.exedescription pid process target process PID 3480 wrote to memory of 1748 3480 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 3480 wrote to memory of 1748 3480 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 3480 wrote to memory of 1748 3480 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 3480 wrote to memory of 1748 3480 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 wrote to memory of 4568 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 wrote to memory of 4568 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 wrote to memory of 4568 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 wrote to memory of 2560 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 wrote to memory of 2560 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 wrote to memory of 2560 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 wrote to memory of 4192 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 wrote to memory of 4192 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe PID 1748 wrote to memory of 4192 1748 31883190ELECTRICAL.exe 31883190ELECTRICAL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exe"C:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exe"C:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exeC:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exe /stext "C:\Users\Admin\AppData\Local\Temp\hhpbmkjyk"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exeC:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exe /stext "C:\Users\Admin\AppData\Local\Temp\sjumncusgqbk"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exeC:\Users\Admin\AppData\Local\Temp\31883190ELECTRICAL.exe /stext "C:\Users\Admin\AppData\Local\Temp\udaenvmtuytpnab"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
188B
MD5f6a0d03abfdd26d5717dcab2dba509a7
SHA1db2c8edd655a519c7f9aa55cc1e8ed078b19febf
SHA256a76e3cce33f14a168f1a11ff4affe429468d7fed2ef243ef769a67c1283f2f5d
SHA5124920defcc7c5aee36ab3408cfa647a066422a36854312f9b43a3fa1f1833e13d7d49ee09e78d68072b04d4794b4e9c8e04583e49bdd228d8a9b1045b3077c19f
-
C:\Users\Admin\AppData\Local\Temp\hhpbmkjykFilesize
4KB
MD559f5e109fab5be401d6bd4ec9761b32a
SHA17de6b60f361f61a2e4567b2f44e5206afc6a23b0
SHA2564829f91f7626e1917bd2882f0356c17596630efbc4883a911eb5c5b2955fb932
SHA51210dd0784bad0d47bf9a2f1f0dcc7f0181df06474808a8104786e43c4392bcc7e3809676d5ecc95d2ce74e043fd329952b03d3efdcd905b15175cccdf385a1a0c
-
C:\Users\Admin\AppData\Local\Temp\nsj6C5C.tmp\System.dllFilesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
memory/1748-152-0x0000000001660000-0x00000000042B0000-memory.dmpFilesize
44.3MB
-
memory/1748-180-0x0000000034E90000-0x0000000034EA9000-memory.dmpFilesize
100KB
-
memory/1748-147-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/1748-151-0x0000000001660000-0x00000000042B0000-memory.dmpFilesize
44.3MB
-
memory/1748-145-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/1748-194-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/1748-191-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/1748-146-0x0000000001660000-0x00000000042B0000-memory.dmpFilesize
44.3MB
-
memory/1748-188-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/1748-185-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/1748-184-0x0000000034E90000-0x0000000034EA9000-memory.dmpFilesize
100KB
-
memory/1748-183-0x0000000034E90000-0x0000000034EA9000-memory.dmpFilesize
100KB
-
memory/2560-160-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2560-155-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2560-163-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2560-168-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3480-144-0x0000000002A90000-0x00000000056E0000-memory.dmpFilesize
44.3MB
-
memory/3480-143-0x0000000002A90000-0x00000000056E0000-memory.dmpFilesize
44.3MB
-
memory/4192-174-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4192-170-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4192-162-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4192-173-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4568-177-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4568-159-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4568-161-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4568-171-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4568-154-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB