Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
General
-
Target
tmp.exe
-
Size
930KB
-
MD5
d7e7e73ea8759c18b068a1eeb155975a
-
SHA1
8f1bf0c0d3fa45598a638ad0abd717be7ab1efaa
-
SHA256
0bd1748c9bcb7917b74f51af9953d5da9aa53f6e6525dd60cc0d50a221cc54aa
-
SHA512
82e699055f2d0c75702f07a40dd70347781c87c905124dbba1bbead8139695247697388b36c5a503389dc3ed8463e033108a7ae767e0fabf9ebea708203c5825
-
SSDEEP
12288:H7mHFFD9GRxjnJfgcuEdhoqVF1N0eF0bWWk++IY8g53aN1qQLAfAV3W:bmXkRNJrD1N0eF0/k+fY8URxA
Malware Config
Extracted
remcos
RemoteHost
134.195.139.194:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-F82W83
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/3840-171-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/3840-173-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/4392-167-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4392-182-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
resource yara_rule behavioral2/memory/3840-171-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/3840-173-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/4392-167-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/4544-179-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4544-180-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4392-182-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2616 set thread context of 4688 2616 tmp.exe 91 PID 4688 set thread context of 4392 4688 tmp.exe 92 PID 4688 set thread context of 3840 4688 tmp.exe 93 PID 4688 set thread context of 4544 4688 tmp.exe 94 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2616 tmp.exe 2616 tmp.exe 4392 tmp.exe 4392 tmp.exe 4544 tmp.exe 4544 tmp.exe 4392 tmp.exe 4392 tmp.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 4688 tmp.exe 4688 tmp.exe 4688 tmp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2616 tmp.exe Token: SeDebugPrivilege 4544 tmp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4688 tmp.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2616 wrote to memory of 3952 2616 tmp.exe 90 PID 2616 wrote to memory of 3952 2616 tmp.exe 90 PID 2616 wrote to memory of 3952 2616 tmp.exe 90 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 2616 wrote to memory of 4688 2616 tmp.exe 91 PID 4688 wrote to memory of 4392 4688 tmp.exe 92 PID 4688 wrote to memory of 4392 4688 tmp.exe 92 PID 4688 wrote to memory of 4392 4688 tmp.exe 92 PID 4688 wrote to memory of 4392 4688 tmp.exe 92 PID 4688 wrote to memory of 3840 4688 tmp.exe 93 PID 4688 wrote to memory of 3840 4688 tmp.exe 93 PID 4688 wrote to memory of 3840 4688 tmp.exe 93 PID 4688 wrote to memory of 3840 4688 tmp.exe 93 PID 4688 wrote to memory of 4544 4688 tmp.exe 94 PID 4688 wrote to memory of 4544 4688 tmp.exe 94 PID 4688 wrote to memory of 4544 4688 tmp.exe 94 PID 4688 wrote to memory of 4544 4688 tmp.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵PID:3952
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\yxwcwxbavocywccjorghusaeihtwun"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\isbnwqmbjwudziqnfctifxumjolfnyucrq"3⤵PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\suofxi"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD50be71b5980b6fc994222b5e743ecc244
SHA12f804f1f3289a21e0f23bddfdf214da49448d20c
SHA25695cde8b98db353b4ce649434ead05b3a7c967dc32529bf05739d8d5b133ec729
SHA512ea4c45089afcd172ec25f28241ff3be28d5e6cf1787a39561611486d68dbfd3cb11edb231448ceeff6443f8f88a9869603b3b937aa33d272dc724d79a31767c9
-
Filesize
4KB
MD53a76b7ef67ef3e8e1f6224d8d1dfd6f6
SHA191ab70d5235504d9382187d324d105e0ec9f18b6
SHA256b4e6c48d47450b4a7860837a4af913ea8d8080ae0f34b8328388c209181592cf
SHA5126040e0c4cb75632c8b131e6d130e8a5b8e265502500648bcd0af2919c1cbcafe0d0967e0141ab3768f8e1d6b3579914a20374139cd51065214da93753f07e0c3