Analysis
-
max time kernel
151s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
19/11/2023, 23:49
Static task
static1
Behavioral task
behavioral1
Sample
653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe
Resource
win10v2004-20231023-en
General
-
Target
653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe
-
Size
360KB
-
MD5
baa40e739a7b86a71f5ce1cc9ef151b8
-
SHA1
67c7f0cf57aff173413f0ba17e9ec5052f1aac86
-
SHA256
653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411
-
SHA512
a6bf3aa52d35cc7119bce93b5166dec0f48692db7b394d54d656a1e8c3871dbfaa17391f894a26d2cedad4d09c316525b122f1689941bd92e008b47940436dbc
-
SSDEEP
6144:wBlL/71aRFGx1f1M/bwy2TtkyVIfjdiYfoRK7pvcHFyXX/Q+dClyOIyS:CJ1GGdcbwy2kyVIblgc1E6XY+dxO7S
Malware Config
Extracted
remcos
JOHN-PC
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IN4YDY
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/2812-51-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/2812-70-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/2884-45-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/2884-61-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral1/memory/2884-45-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2812-51-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/2940-53-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2940-54-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2940-55-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2884-61-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2812-70-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft -
Executes dropped EXE 5 IoCs
pid Process 2076 hmgffhl.exe 2972 hmgffhl.exe 2884 hmgffhl.exe 2812 hmgffhl.exe 2940 hmgffhl.exe -
Loads dropped DLL 6 IoCs
pid Process 840 653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe 840 653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe 2076 hmgffhl.exe 2972 hmgffhl.exe 2972 hmgffhl.exe 2972 hmgffhl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2972-14-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-17-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-18-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-19-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-20-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-21-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-22-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-23-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-24-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-25-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-26-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-27-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-28-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-29-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-30-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-31-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-33-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-64-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-73-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-75-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-76-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-77-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-78-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-79-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-80-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-81-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-82-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-83-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-84-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-85-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-87-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-88-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-89-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-90-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-91-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-92-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral1/memory/2972-93-0x0000000000400000-0x000000000048B000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts hmgffhl.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Run\xgcluqajfoktdy = "C:\\Users\\Admin\\AppData\\Roaming\\clhqm\\vfbktpyuenjsc.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hmgffhl.exe\" " hmgffhl.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2076 set thread context of 2972 2076 hmgffhl.exe 29 PID 2972 set thread context of 2884 2972 hmgffhl.exe 33 PID 2972 set thread context of 2812 2972 hmgffhl.exe 34 PID 2972 set thread context of 2940 2972 hmgffhl.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2884 hmgffhl.exe 2884 hmgffhl.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 2076 hmgffhl.exe 2972 hmgffhl.exe 2972 hmgffhl.exe 2972 hmgffhl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2940 hmgffhl.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 840 wrote to memory of 2076 840 653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe 28 PID 840 wrote to memory of 2076 840 653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe 28 PID 840 wrote to memory of 2076 840 653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe 28 PID 840 wrote to memory of 2076 840 653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe 28 PID 2076 wrote to memory of 2972 2076 hmgffhl.exe 29 PID 2076 wrote to memory of 2972 2076 hmgffhl.exe 29 PID 2076 wrote to memory of 2972 2076 hmgffhl.exe 29 PID 2076 wrote to memory of 2972 2076 hmgffhl.exe 29 PID 2076 wrote to memory of 2972 2076 hmgffhl.exe 29 PID 2972 wrote to memory of 2884 2972 hmgffhl.exe 33 PID 2972 wrote to memory of 2884 2972 hmgffhl.exe 33 PID 2972 wrote to memory of 2884 2972 hmgffhl.exe 33 PID 2972 wrote to memory of 2884 2972 hmgffhl.exe 33 PID 2972 wrote to memory of 2812 2972 hmgffhl.exe 34 PID 2972 wrote to memory of 2812 2972 hmgffhl.exe 34 PID 2972 wrote to memory of 2812 2972 hmgffhl.exe 34 PID 2972 wrote to memory of 2812 2972 hmgffhl.exe 34 PID 2972 wrote to memory of 2940 2972 hmgffhl.exe 35 PID 2972 wrote to memory of 2940 2972 hmgffhl.exe 35 PID 2972 wrote to memory of 2940 2972 hmgffhl.exe 35 PID 2972 wrote to memory of 2940 2972 hmgffhl.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe"C:\Users\Admin\AppData\Local\Temp\653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exe"C:\Users\Admin\AppData\Local\Temp\hmgffhl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exe"C:\Users\Admin\AppData\Local\Temp\hmgffhl.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exeC:\Users\Admin\AppData\Local\Temp\hmgffhl.exe /stext "C:\Users\Admin\AppData\Local\Temp\jiadtlrwtvzficaozdflklynpwhtlharx"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exeC:\Users\Admin\AppData\Local\Temp\hmgffhl.exe /stext "C:\Users\Admin\AppData\Local\Temp\ukfou"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exeC:\Users\Admin\AppData\Local\Temp\hmgffhl.exe /stext "C:\Users\Admin\AppData\Local\Temp\welguwnrd"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
252KB
MD5ddbc7a941cc8a41868214bf457414ba3
SHA19863a26f3e01f83959063b788cd1454363822e01
SHA2563a771752b239f75a7bbef2e0e95d8ba7d74c5f070160e970c15325c1d5502735
SHA512667960b374d7ed49966c37e2fab808176f0d28e2c5fd3afc8c2ccdde0618e0b974cc4393005794cdff63069ce58b68238f4e5f2e94dc754a6c3ada688fd99099
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd