Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 17:36
Static task
static1
Behavioral task
behavioral1
Sample
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe
Resource
win10v2004-20231130-en
General
-
Target
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe
-
Size
1.0MB
-
MD5
c200bdcd9c827ad9c878f61a6e80b2ee
-
SHA1
730d6b83b8af8d7b6740020d0e44466c2192f6ee
-
SHA256
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd
-
SHA512
a5dd81fe25aa643c94f5e098e17fc2ce9a929141ea3a470245986e3e5fb8d9da8c014f6649a70816f8d1338b043a09caea69193f627f8c1bf351becb8d76de43
-
SSDEEP
24576:KgCKtD/61Idz9KOXdI0YBt68T1U3FMztS5aV3+2rN87:X6Kzj+0YBt68+3FMKaO2h87
Malware Config
Extracted
remcos
RemoteHost
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IZFV1M
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1812-71-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/1812-88-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/2408-60-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/2408-80-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2408-60-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/932-70-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1812-71-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/932-72-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2408-80-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1812-88-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exefc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exedescription pid process target process PID 2868 set thread context of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 set thread context of 2408 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 set thread context of 1812 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 set thread context of 932 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exepowershell.exepowershell.exefc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exepid process 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe 2716 powershell.exe 2652 powershell.exe 2408 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe 2408 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exepid process 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exepowershell.exepowershell.exefc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exedescription pid process Token: SeDebugPrivilege 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe Token: SeDebugPrivilege 2716 powershell.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 932 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exepid process 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exefc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exedescription pid process target process PID 2868 wrote to memory of 2716 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe powershell.exe PID 2868 wrote to memory of 2716 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe powershell.exe PID 2868 wrote to memory of 2716 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe powershell.exe PID 2868 wrote to memory of 2716 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe powershell.exe PID 2868 wrote to memory of 2652 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe powershell.exe PID 2868 wrote to memory of 2652 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe powershell.exe PID 2868 wrote to memory of 2652 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe powershell.exe PID 2868 wrote to memory of 2652 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe powershell.exe PID 2868 wrote to memory of 2692 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe schtasks.exe PID 2868 wrote to memory of 2692 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe schtasks.exe PID 2868 wrote to memory of 2692 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe schtasks.exe PID 2868 wrote to memory of 2692 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe schtasks.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2868 wrote to memory of 2660 2868 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 2408 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 2408 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 2408 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 2408 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 2408 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 1812 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 1812 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 1812 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 1812 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 1812 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 932 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 932 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 932 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 932 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe PID 2660 wrote to memory of 932 2660 fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe"C:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GwdCcjuxCiQA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GwdCcjuxCiQA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD3E2.tmp"2⤵
- Creates scheduled task(s)
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe"C:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exeC:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe /stext "C:\Users\Admin\AppData\Local\Temp\kfnmylyhyfvmjczknyyuyoqonrqcrdh"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exeC:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe /stext "C:\Users\Admin\AppData\Local\Temp\uhtxrdjjmnnruivofjlvbtkfwgidkoymty"3⤵
- Accesses Microsoft Outlook accounts
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exeC:\Users\Admin\AppData\Local\Temp\fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd.exe /stext "C:\Users\Admin\AppData\Local\Temp\xcypsvt"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD555e6bfffcb10f3ab08a3c2fbe1839087
SHA1d9fdcc9c92b06d94221e7decad0e2dfecd74f662
SHA256e9fce4366bd33f8e99e0a145c84cfe03eca82b040a5a30b3dfdd61c1e21c5663
SHA512708d500d110710fadd055f94b7a6f31dbaa440d80ed1bb0ec71eedf0aed30a84b7b145b85c87431b6ca052647ee8dc6a89d1c6e76c59fb29254696af1d86537e
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
1KB
MD5bd6d3f8dc518bbf4d7695b69f1cf1fdb
SHA10b9d0b8eb0edef2e063e2c9e16d4896dedbd4246
SHA256a56adad54b7d2e8f4d6b868e3cbd87e27cc6d86c60e7a6e447d5f1f9b3fe3782
SHA51271a128513b82dc343b707bdf3f8f084baa67122d29c9761687742c860c33823f8f650f98885dc42c6379578ed39ffcc689bc028b10927cfa074c2598264b7b42
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4UGCIF5KJLJI7KVXK52O.temp
Filesize7KB
MD59a52cdd720d600b74dc53e32b879581b
SHA1b5f59e97d8688176f6fd80e3a1a521b0a0f08321
SHA256111bde4d8fb7edf91441db7b1a3077034dac602efc2ad70f0e5a1b5dfc1e27f3
SHA512c1a47d068ba717ddf856cf374de4545c0a2ed5c7c0d560dddea1f36752056b44533b974e189076c051c6b8af2f3676238f2cf927dac1be765d882ece3ed48f88
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD59a52cdd720d600b74dc53e32b879581b
SHA1b5f59e97d8688176f6fd80e3a1a521b0a0f08321
SHA256111bde4d8fb7edf91441db7b1a3077034dac602efc2ad70f0e5a1b5dfc1e27f3
SHA512c1a47d068ba717ddf856cf374de4545c0a2ed5c7c0d560dddea1f36752056b44533b974e189076c051c6b8af2f3676238f2cf927dac1be765d882ece3ed48f88