Analysis Overview
SHA256
a175371e9373a87e16ced87d403fb50247705163ea786a5eba3209cb66ed4390
Threat Level: Known bad
The file 17020384843af0d57b8c47e4f7c45e8ba4414521303dd4972bbccb99aeb71a0d3645cbebd8676.dat-decoded.exe was found to be: Known bad.
Malicious Activity Summary
Remcos family
Unsigned PE
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-12-08 12:31
Signatures
Remcos family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-08 12:31
Reported
2023-12-08 12:35
Platform
win7-20231023-en
Max time kernel
148s
Max time network
145s
Command Line
Signatures
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\17020384843af0d57b8c47e4f7c45e8ba4414521303dd4972bbccb99aeb71a0d3645cbebd8676.dat-decoded.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\17020384843af0d57b8c47e4f7c45e8ba4414521303dd4972bbccb99aeb71a0d3645cbebd8676.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17020384843af0d57b8c47e4f7c45e8ba4414521303dd4972bbccb99aeb71a0d3645cbebd8676.dat-decoded.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | sembe.duckdns.org | udp |
| BE | 194.187.251.115:14645 | sembe.duckdns.org | tcp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
Files
C:\Users\Admin\AppData\Roaming\notess\logs.dat
| MD5 | 27fdffb69e432cc4b97381dc0fa17494 |
| SHA1 | 50b5e8feb23eed737741408d656c7c4fad378fda |
| SHA256 | c6cf171fabf747f7a22e25d43ba0a6f46a7e10da048ee90d6f9a2f20a4bdfd31 |
| SHA512 | 92f0275ca4791b554637e9907916294cb3600f197adb822970b6c50c130f6dcc584928492b343d422d3f11895df74f07cae4a4501fa7aeb37b9094b0d1f5cdff |
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-08 12:31
Reported
2023-12-08 12:37
Platform
win10v2004-20231127-en
Max time kernel
150s
Max time network
139s
Command Line
Signatures
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\17020384843af0d57b8c47e4f7c45e8ba4414521303dd4972bbccb99aeb71a0d3645cbebd8676.dat-decoded.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\17020384843af0d57b8c47e4f7c45e8ba4414521303dd4972bbccb99aeb71a0d3645cbebd8676.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17020384843af0d57b8c47e4f7c45e8ba4414521303dd4972bbccb99aeb71a0d3645cbebd8676.dat-decoded.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.1.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | sembe.duckdns.org | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| BE | 194.187.251.115:14645 | sembe.duckdns.org | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 115.251.187.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| US | 8.8.8.8:53 | 50.33.237.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.252.72.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.65.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Roaming\notess\logs.dat
| MD5 | 3d7c767ea61f70e6663c2528240c527a |
| SHA1 | a423fb8d463f1840801b3e13e4b0cd2d1e00f93c |
| SHA256 | 909cea02debcc312529b80974d3105e67882f64f4cb5d1f3a64cf0d5ba22e5bc |
| SHA512 | 3cee1e79f6113c2b5b4fd5a19625571dc97d420b30a096fbab335724b21708b62bbc758bad6ad052a04215a5b345d14d82d3ed1a1432edc31ea3a445d695ff95 |