Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-06-2023 04:38
Static task
static1
Behavioral task
behavioral1
Sample
33108fe9d2b46a295190763ebb4083f7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
33108fe9d2b46a295190763ebb4083f7.exe
Resource
win10v2004-20230220-en
General
-
Target
33108fe9d2b46a295190763ebb4083f7.exe
-
Size
898KB
-
MD5
33108fe9d2b46a295190763ebb4083f7
-
SHA1
28926c7fd4b1271230a0cfcf2d193ef7cd08e17d
-
SHA256
99e559cde8a3871a1c1d045ff0f141d01aeff386c2798c127fdacdff6b193f17
-
SHA512
005060e50f1ddc3d721981fe433bd1a6ab9c4b57b965aa83aeab590220bd2a06aa93df25a59d5ed31e3947d85903c4910092632d27e79ad489d9af36d073458f
-
SSDEEP
12288:1epHyX2+Q6gmk12kka/ZzT9+CnHYNTQErfawt5IPzKi0:1epJHDskkKpT9hGZrfHtUzK
Malware Config
Extracted
remcos
RemoteHost
divdemoce.duckdns.org:35639
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
dtas.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-GZATCK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1076-103-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/1076-113-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/1076-115-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/836-101-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/836-112-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral1/memory/836-101-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1076-103-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/1356-105-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1356-106-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/836-112-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1076-113-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/1076-115-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts AddInProcess32.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
33108fe9d2b46a295190763ebb4083f7.exeAddInProcess32.exedescription pid process target process PID 2012 set thread context of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 1116 set thread context of 836 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 set thread context of 1076 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 set thread context of 1356 1116 AddInProcess32.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
33108fe9d2b46a295190763ebb4083f7.exepid process 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe 2012 33108fe9d2b46a295190763ebb4083f7.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
AddInProcess32.exepid process 1116 AddInProcess32.exe 1116 AddInProcess32.exe 1116 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
33108fe9d2b46a295190763ebb4083f7.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 2012 33108fe9d2b46a295190763ebb4083f7.exe Token: SeDebugPrivilege 1356 AddInProcess32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid process 1116 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
33108fe9d2b46a295190763ebb4083f7.exeAddInProcess32.exedescription pid process target process PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 2012 wrote to memory of 1116 2012 33108fe9d2b46a295190763ebb4083f7.exe AddInProcess32.exe PID 1116 wrote to memory of 836 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 836 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 836 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 836 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 836 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1076 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1076 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1076 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1076 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1076 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1356 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1356 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1356 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1356 1116 AddInProcess32.exe AddInProcess32.exe PID 1116 wrote to memory of 1356 1116 AddInProcess32.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33108fe9d2b46a295190763ebb4083f7.exe"C:\Users\Admin\AppData\Local\Temp\33108fe9d2b46a295190763ebb4083f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\pkpgayt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\reuraidsfs"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\cgajbbottalbe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pkpgaytFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\remcos\dtas.datFilesize
144B
MD50dd07490fecc96faf6b48964d808a3ed
SHA1796cb1f8144c22561e4d0b7440bb69788816edbc
SHA25634ed6779877a363b1c1c6ca33237361371fa6808cc0a85c01119e3bf6d880940
SHA512b0ab30ea86afb17e2781e7b455db9a3ec934be0aa99ab90070dd376890f747de9ddaf40b72780be575eecdd1254a78718e50a0d3a677f595090d44a1623c20ba
-
memory/836-91-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/836-112-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/836-101-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/836-95-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1076-115-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1076-113-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1076-103-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1076-99-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1076-94-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1116-83-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-64-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-67-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-68-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-69-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1116-142-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-141-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-134-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-74-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-75-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-76-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-78-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-79-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-80-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-81-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-82-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-133-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-84-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-86-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-88-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-89-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-65-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-66-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-63-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-62-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-127-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-126-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-122-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/1116-121-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1116-120-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/1116-117-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/1356-106-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1356-98-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1356-105-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1356-104-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2012-56-0x0000000000770000-0x00000000007BA000-memory.dmpFilesize
296KB
-
memory/2012-59-0x0000000000490000-0x00000000004D0000-memory.dmpFilesize
256KB
-
memory/2012-57-0x00000000004D0000-0x00000000004E8000-memory.dmpFilesize
96KB
-
memory/2012-60-0x0000000000BE0000-0x0000000000BFA000-memory.dmpFilesize
104KB
-
memory/2012-55-0x0000000000490000-0x00000000004D0000-memory.dmpFilesize
256KB
-
memory/2012-61-0x00000000007C0000-0x00000000007C6000-memory.dmpFilesize
24KB
-
memory/2012-58-0x0000000000490000-0x00000000004D0000-memory.dmpFilesize
256KB
-
memory/2012-54-0x0000000000F30000-0x0000000001016000-memory.dmpFilesize
920KB
-
memory/2012-73-0x0000000000490000-0x00000000004D0000-memory.dmpFilesize
256KB
-
memory/2012-72-0x0000000000490000-0x00000000004D0000-memory.dmpFilesize
256KB
-
memory/2012-71-0x0000000000490000-0x00000000004D0000-memory.dmpFilesize
256KB