Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2023, 23:49
Static task
static1
Behavioral task
behavioral1
Sample
653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe
Resource
win10v2004-20231023-en
General
-
Target
653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe
-
Size
360KB
-
MD5
baa40e739a7b86a71f5ce1cc9ef151b8
-
SHA1
67c7f0cf57aff173413f0ba17e9ec5052f1aac86
-
SHA256
653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411
-
SHA512
a6bf3aa52d35cc7119bce93b5166dec0f48692db7b394d54d656a1e8c3871dbfaa17391f894a26d2cedad4d09c316525b122f1689941bd92e008b47940436dbc
-
SSDEEP
6144:wBlL/71aRFGx1f1M/bwy2TtkyVIfjdiYfoRK7pvcHFyXX/Q+dClyOIyS:CJ1GGdcbwy2kyVIblgc1E6XY+dxO7S
Malware Config
Extracted
remcos
JOHN-PC
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IN4YDY
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/1476-38-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/1476-40-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2240-36-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/2240-47-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
resource yara_rule behavioral2/memory/4980-34-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2240-36-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/1476-38-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/1476-40-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/4980-39-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2240-47-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Executes dropped EXE 5 IoCs
pid Process 1724 hmgffhl.exe 740 hmgffhl.exe 2240 hmgffhl.exe 1476 hmgffhl.exe 4980 hmgffhl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/740-10-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-8-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-11-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-13-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-12-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-14-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-15-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-17-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-16-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-19-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-18-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-21-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-57-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-58-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-59-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-60-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-61-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-62-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-63-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-65-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-66-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-68-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-69-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-70-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-71-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-72-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-73-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-74-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-75-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-76-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-77-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-78-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-79-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-80-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-81-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-82-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-83-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/740-84-0x0000000000400000-0x000000000048B000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts hmgffhl.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xgcluqajfoktdy = "C:\\Users\\Admin\\AppData\\Roaming\\clhqm\\vfbktpyuenjsc.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hmgffhl.exe\" " hmgffhl.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1724 set thread context of 740 1724 hmgffhl.exe 88 PID 740 set thread context of 2240 740 hmgffhl.exe 91 PID 740 set thread context of 1476 740 hmgffhl.exe 92 PID 740 set thread context of 4980 740 hmgffhl.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4980 hmgffhl.exe 4980 hmgffhl.exe 2240 hmgffhl.exe 2240 hmgffhl.exe 2240 hmgffhl.exe 2240 hmgffhl.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 1724 hmgffhl.exe 740 hmgffhl.exe 740 hmgffhl.exe 740 hmgffhl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4980 hmgffhl.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1428 wrote to memory of 1724 1428 653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe 87 PID 1428 wrote to memory of 1724 1428 653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe 87 PID 1428 wrote to memory of 1724 1428 653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe 87 PID 1724 wrote to memory of 740 1724 hmgffhl.exe 88 PID 1724 wrote to memory of 740 1724 hmgffhl.exe 88 PID 1724 wrote to memory of 740 1724 hmgffhl.exe 88 PID 1724 wrote to memory of 740 1724 hmgffhl.exe 88 PID 740 wrote to memory of 2240 740 hmgffhl.exe 91 PID 740 wrote to memory of 2240 740 hmgffhl.exe 91 PID 740 wrote to memory of 2240 740 hmgffhl.exe 91 PID 740 wrote to memory of 1476 740 hmgffhl.exe 92 PID 740 wrote to memory of 1476 740 hmgffhl.exe 92 PID 740 wrote to memory of 1476 740 hmgffhl.exe 92 PID 740 wrote to memory of 4980 740 hmgffhl.exe 93 PID 740 wrote to memory of 4980 740 hmgffhl.exe 93 PID 740 wrote to memory of 4980 740 hmgffhl.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe"C:\Users\Admin\AppData\Local\Temp\653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exe"C:\Users\Admin\AppData\Local\Temp\hmgffhl.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exe"C:\Users\Admin\AppData\Local\Temp\hmgffhl.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exeC:\Users\Admin\AppData\Local\Temp\hmgffhl.exe /stext "C:\Users\Admin\AppData\Local\Temp\guvaroaffmxjxtmndnuibwp"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exeC:\Users\Admin\AppData\Local\Temp\hmgffhl.exe /stext "C:\Users\Admin\AppData\Local\Temp\qpjsrhkztupozhazmxhjebkhhq"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:1476
-
-
C:\Users\Admin\AppData\Local\Temp\hmgffhl.exeC:\Users\Admin\AppData\Local\Temp\hmgffhl.exe /stext "C:\Users\Admin\AppData\Local\Temp\brodszvapchbjnwdvibdpofqqxrmx"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5e4a10383112b65cf1ebe152e69b201e1
SHA15bd437d88f7e4b7bca224d14ee4997c8ed523696
SHA256298b628b00621049409f66f81960f7faaa38f2c68adf7cf50c315c199c7b4ea9
SHA512bd6e072d08538cf69b35c2157e17b4eae4f6c10ad209dacb5766fc312ef1a5a576e925de8406efac9cb8b6c29d5f5b077371a8fba58b6ff183d0cf8dbb2dae2d
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
179KB
MD5af8589ad7b9edf29559886b6c11320c5
SHA127c66de8bbaa255d5ed3e200119b8f5f443ddf52
SHA256d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716
SHA512b5203bd31d3bd6047bfd1648b6bd308ec7c46d5566962b695e06209184f24224bf2a9094744330cbb1e037f914d4bdd625165773d992145a8c38b74ab0348ecd
-
Filesize
252KB
MD5ddbc7a941cc8a41868214bf457414ba3
SHA19863a26f3e01f83959063b788cd1454363822e01
SHA2563a771752b239f75a7bbef2e0e95d8ba7d74c5f070160e970c15325c1d5502735
SHA512667960b374d7ed49966c37e2fab808176f0d28e2c5fd3afc8c2ccdde0618e0b974cc4393005794cdff63069ce58b68238f4e5f2e94dc754a6c3ada688fd99099