Analysis Overview
SHA256
73cd192a1e2293fe540169fa1d0367699b00a6a005d9a913a48d0ef65cca64d0
Threat Level: Known bad
The file G9876545678009876.XZ.zip was found to be: Known bad.
Malicious Activity Summary
Remcos
NirSoft WebBrowserPassView
NirSoft MailPassView
Nirsoft
Drops startup file
Accesses Microsoft Outlook accounts
Suspicious use of SetThreadContext
Program crash
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-12-08 09:45
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-08 09:45
Reported
2023-12-08 09:47
Platform
win7-20231201-en
Max time kernel
148s
Max time network
149s
Command Line
Signatures
Remcos
NirSoft MailPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
NirSoft WebBrowserPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Nirsoft
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
Accesses Microsoft Outlook accounts
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2940 set thread context of 2692 | N/A | C:\Users\Admin\AppData\Local\Temp\G9876545678009876.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe |
| PID 2692 set thread context of 2152 | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe |
| PID 2692 set thread context of 1868 | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe |
| PID 2692 set thread context of 2660 | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\G9876545678009876.exe
"C:\Users\Admin\AppData\Local\Temp\G9876545678009876.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\G9876545678009876.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /stext "C:\Users\Admin\AppData\Local\Temp\fzctfclgbojribmjgoaqpfylt"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /stext "C:\Users\Admin\AppData\Local\Temp\pthlgvwhpwbdspanpzmssjsccqpi"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /stext "C:\Users\Admin\AppData\Local\Temp\anuwhngbletivvwrhjzldwntcxgrffux"
Network
| Country | Destination | Domain | Proto |
| US | 107.175.229.139:8087 | tcp | |
| US | 107.175.229.139:8087 | tcp | |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
Files
memory/2940-0-0x0000000001240000-0x0000000001304000-memory.dmp
memory/2940-1-0x0000000074940000-0x000000007502E000-memory.dmp
memory/2940-2-0x0000000000650000-0x0000000000690000-memory.dmp
memory/2940-3-0x0000000000EF0000-0x0000000000F9E000-memory.dmp
memory/2092-6-0x0000000070040000-0x00000000705EB000-memory.dmp
memory/2092-7-0x0000000070040000-0x00000000705EB000-memory.dmp
memory/2092-8-0x00000000028E0000-0x0000000002920000-memory.dmp
memory/2092-10-0x0000000070040000-0x00000000705EB000-memory.dmp
memory/2940-11-0x0000000000260000-0x0000000000268000-memory.dmp
memory/2692-12-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-13-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-14-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-15-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-16-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-17-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-18-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-19-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-21-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2940-23-0x0000000074940000-0x000000007502E000-memory.dmp
memory/2692-20-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2692-27-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-25-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-24-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-29-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-28-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-30-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-31-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-32-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-33-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-35-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2152-38-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2152-43-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1868-42-0x0000000000400000-0x0000000000457000-memory.dmp
memory/2152-47-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1868-49-0x0000000000400000-0x0000000000457000-memory.dmp
memory/1868-51-0x0000000000400000-0x0000000000457000-memory.dmp
memory/1868-53-0x0000000000400000-0x0000000000457000-memory.dmp
memory/2660-50-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2660-54-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2660-56-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2660-57-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2152-62-0x0000000000400000-0x0000000000478000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fzctfclgbojribmjgoaqpfylt
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
memory/1868-65-0x0000000000400000-0x0000000000457000-memory.dmp
memory/2692-66-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2692-70-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2692-69-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2692-72-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2692-71-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-75-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-77-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-78-0x0000000000400000-0x0000000000482000-memory.dmp
C:\ProgramData\remcos\logs.dat
| MD5 | b192bccaa38e247c338b07d54c70c2f2 |
| SHA1 | 294111c160a4260f8e4dc2196cb563990c18cd1b |
| SHA256 | f4332ecfd01c3c0c456970c6304fe2c18042655f74b9dc84e6f30907b3c88726 |
| SHA512 | 32766d409755386ea0a5fb8a77edfd7e6e7d431437dc9e18828bf0189100615e18f4ef194ad2bbf6ca6e91a5acb1584026ff42d687976ff25995ef4348efd423 |
memory/2692-85-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-86-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-93-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2692-94-0x0000000000400000-0x0000000000482000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-08 09:45
Reported
2023-12-08 09:47
Platform
win10v2004-20231130-en
Max time kernel
150s
Max time network
144s
Command Line
Signatures
Remcos
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 652 set thread context of 4204 | N/A | C:\Users\Admin\AppData\Local\Temp\G9876545678009876.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\svchost.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\G9876545678009876.exe
"C:\Users\Admin\AppData\Local\Temp\G9876545678009876.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\G9876545678009876.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4204 -ip 4204
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 512
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 19.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.241.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 176.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
memory/652-0-0x0000000000030000-0x00000000000F4000-memory.dmp
memory/652-1-0x0000000074D10000-0x00000000754C0000-memory.dmp
memory/652-3-0x0000000004A90000-0x0000000004B3E000-memory.dmp
memory/652-2-0x0000000004BB0000-0x0000000004BC0000-memory.dmp
memory/652-4-0x0000000005170000-0x0000000005714000-memory.dmp
memory/652-5-0x0000000004C60000-0x0000000004CF2000-memory.dmp
memory/652-6-0x0000000004D00000-0x0000000004D9C000-memory.dmp
memory/2252-8-0x0000000074D10000-0x00000000754C0000-memory.dmp
memory/2252-9-0x0000000002EC0000-0x0000000002ED0000-memory.dmp
memory/2252-7-0x0000000002F10000-0x0000000002F46000-memory.dmp
memory/2252-11-0x0000000005AA0000-0x00000000060C8000-memory.dmp
memory/2252-10-0x0000000002EC0000-0x0000000002ED0000-memory.dmp
memory/2252-12-0x0000000005840000-0x0000000005862000-memory.dmp
memory/2252-13-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/2252-14-0x00000000061D0000-0x0000000006236000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nzed5zf0.vvl.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2252-24-0x0000000006240000-0x0000000006594000-memory.dmp
memory/2252-25-0x0000000006810000-0x000000000682E000-memory.dmp
memory/2252-26-0x0000000006850000-0x000000000689C000-memory.dmp
memory/652-27-0x0000000004B80000-0x0000000004B88000-memory.dmp
memory/4204-28-0x0000000000430000-0x00000000004B2000-memory.dmp
memory/652-32-0x0000000074D10000-0x00000000754C0000-memory.dmp
memory/4204-36-0x0000000000430000-0x00000000004B2000-memory.dmp
memory/4204-41-0x0000000000430000-0x00000000004B2000-memory.dmp
memory/2252-43-0x0000000006CE0000-0x0000000006CFA000-memory.dmp
memory/2252-44-0x0000000006D80000-0x0000000006DA2000-memory.dmp
memory/2252-42-0x00000000077D0000-0x0000000007866000-memory.dmp
memory/2252-48-0x0000000074D10000-0x00000000754C0000-memory.dmp
memory/4324-49-0x0000024614690000-0x00000246146A0000-memory.dmp
memory/4324-65-0x0000024614790000-0x00000246147A0000-memory.dmp
memory/4324-81-0x000002461CD80000-0x000002461CD81000-memory.dmp
memory/4324-82-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-83-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-84-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-85-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-86-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-87-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-88-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-89-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-90-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-91-0x000002461CDB0000-0x000002461CDB1000-memory.dmp
memory/4324-92-0x000002461C9D0000-0x000002461C9D1000-memory.dmp
memory/4324-93-0x000002461C9C0000-0x000002461C9C1000-memory.dmp
memory/4324-95-0x000002461C9D0000-0x000002461C9D1000-memory.dmp
memory/4324-98-0x000002461C9C0000-0x000002461C9C1000-memory.dmp
memory/4324-101-0x000002461C900000-0x000002461C901000-memory.dmp
memory/4324-113-0x000002461CB00000-0x000002461CB01000-memory.dmp
memory/4324-115-0x000002461CB10000-0x000002461CB11000-memory.dmp
memory/4324-116-0x000002461CB10000-0x000002461CB11000-memory.dmp