977cb1283020fcf7c702fdaf6ec84822bb0f9486039c53ba538d3a5f0b59dc46

General

Target

Remiitance copy.exe
Size

879KB
MD5

c9957168d370ff036e0c72e32b3f49c8
SHA1

4112ea71f673090036871d3ab57a67ddc62f83d5
SHA256

aec5d1b5fa3a905ce36b592492e8a51bfa68503f774724b0f936151f138016fb
SHA512

0d0b0377fcd4861321d68e45a2a75fa50e7ddef9ab9cbe7996b744da541c1aabff8740d68899ade9f6779af471f5b62e19a37230a76a6d95541ea4d1b6274464
SSDEEP

24576:bqGtyT2IyUrb0ZmSmUo9v7IFoKVzvlOE1D6Vf:7MzrbJjKFHzv4AD

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 2548	2212	Remiitance copy.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2212	Remiitance copy.exe
2212	Remiitance copy.exe
2212	Remiitance copy.exe
2548	Remiitance copy.exe
2548	Remiitance copy.exe
2400	powershell.exe
2644	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	Remiitance copy.exe
Token: SeDebugPrivilege	2548	Remiitance copy.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2400	2212	Remiitance copy.exe	28
PID 2212 wrote to memory of 2400	2212	Remiitance copy.exe	28
PID 2212 wrote to memory of 2400	2212	Remiitance copy.exe	28
PID 2212 wrote to memory of 2400	2212	Remiitance copy.exe	28
PID 2212 wrote to memory of 2644	2212	Remiitance copy.exe	30
PID 2212 wrote to memory of 2644	2212	Remiitance copy.exe	30
PID 2212 wrote to memory of 2644	2212	Remiitance copy.exe	30
PID 2212 wrote to memory of 2644	2212	Remiitance copy.exe	30
PID 2212 wrote to memory of 2776	2212	Remiitance copy.exe	32
PID 2212 wrote to memory of 2776	2212	Remiitance copy.exe	32
PID 2212 wrote to memory of 2776	2212	Remiitance copy.exe	32
PID 2212 wrote to memory of 2776	2212	Remiitance copy.exe	32
PID 2212 wrote to memory of 2548	2212	Remiitance copy.exe	34
PID 2212 wrote to memory of 2548	2212	Remiitance copy.exe	34
PID 2212 wrote to memory of 2548	2212	Remiitance copy.exe	34
PID 2212 wrote to memory of 2548	2212	Remiitance copy.exe	34
PID 2212 wrote to memory of 2548	2212	Remiitance copy.exe	34
PID 2212 wrote to memory of 2548	2212	Remiitance copy.exe	34
PID 2212 wrote to memory of 2548	2212	Remiitance copy.exe	34
PID 2212 wrote to memory of 2548	2212	Remiitance copy.exe	34
PID 2212 wrote to memory of 2548	2212	Remiitance copy.exe	34

C:\Users\Admin\AppData\Local\Temp\Remiitance copy.exe
"C:\Users\Admin\AppData\Local\Temp\Remiitance copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Remiitance copy.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IakDLlRpqUf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IakDLlRpqUf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF6F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\Remiitance copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Remiitance copy.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCF6F.tmp

Filesize
1KB

MD5
ab864bce35f37c00b3c2a68f75a294a5

SHA1
df7ac437b8beb757bc0ef9f1fff2a7355583e148

SHA256
1e5d3a73b95bd61091324ca39fd1803dc27a066db3567dd74aad60f49e392317

SHA512
0131470f4feb77b9b47a774257b068d2691599e663d0a8578c16656e64b3a5b453024a3a9c6d4cf7fd5c2c63c35fed2d344745dedf1ba6d3c04d886fcec37369

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G7JP87YN0YT8HA2APEEZ.temp

Filesize
7KB

MD5
9a178ae200ca92129c17d5329bf64d82

SHA1
5b3178bb64f731de1e416b49248c71d94d7927aa

SHA256
cb95b96b0527e3709e980604931bceaa8c0136e1bb13e3442b7ae0441db365cb

SHA512
94cfa08a5f78f25a5306132a3aae11e55046b743e9d18996b4c50687ce74bee3a7f4bd79ab58777d596af4ce3164dd733d6cd6b5c14bcb0d5a2b934cd728b4a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
9a178ae200ca92129c17d5329bf64d82

SHA1
5b3178bb64f731de1e416b49248c71d94d7927aa

SHA256
cb95b96b0527e3709e980604931bceaa8c0136e1bb13e3442b7ae0441db365cb

SHA512
94cfa08a5f78f25a5306132a3aae11e55046b743e9d18996b4c50687ce74bee3a7f4bd79ab58777d596af4ce3164dd733d6cd6b5c14bcb0d5a2b934cd728b4a5

Download Submit
memory/2212-4-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-5-0x0000000004F00000-0x0000000004F40000-memory.dmp

Filesize
256KB

Download
memory/2212-6-0x0000000000380000-0x0000000000390000-memory.dmp

Filesize
64KB

Download
memory/2212-7-0x0000000007680000-0x00000000076FA000-memory.dmp

Filesize
488KB

Download
memory/2212-3-0x00000000003A0000-0x00000000003BC000-memory.dmp

Filesize
112KB

Download
memory/2212-2-0x0000000004F00000-0x0000000004F40000-memory.dmp

Filesize
256KB

Download
memory/2212-1-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-35-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-0-0x0000000000280000-0x0000000000362000-memory.dmp

Filesize
904KB

Download
memory/2400-31-0x000000006F2D0000-0x000000006F87B000-memory.dmp

Filesize
5.7MB

Download
memory/2400-41-0x000000006F2D0000-0x000000006F87B000-memory.dmp

Filesize
5.7MB

Download
memory/2400-34-0x0000000001F40000-0x0000000001F80000-memory.dmp

Filesize
256KB

Download
memory/2400-25-0x000000006F2D0000-0x000000006F87B000-memory.dmp

Filesize
5.7MB

Download
memory/2548-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-44-0x0000000002350000-0x0000000002390000-memory.dmp

Filesize
256KB

Download
memory/2548-43-0x0000000073140000-0x000000007382E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2548-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-36-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-40-0x0000000073140000-0x000000007382E000-memory.dmp

Filesize
6.9MB

Download
memory/2644-37-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/2644-42-0x000000006F2D0000-0x000000006F87B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-27-0x000000006F2D0000-0x000000006F87B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-29-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads