Malware Analysis Report

2025-08-10 16:48

Sample ID 240213-c66pgadd26
Target 3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
SHA256 3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b
Tags
remcos p2-bin collection rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b

Threat Level: Known bad

The file 3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe was found to be: Known bad.

Malicious Activity Summary

remcos p2-bin collection rat spyware stealer

Remcos

Detects executables built or packed with MPress PE compressor

NirSoft MailPassView

Nirsoft

NirSoft WebBrowserPassView

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Checks computer location settings

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-13 02:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-13 02:42

Reported

2024-02-13 02:46

Platform

win7-20231129-en

Max time kernel

148s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"

Signatures

Remcos

rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2548 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2548 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\schtasks.exe
PID 2548 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\schtasks.exe
PID 2548 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\schtasks.exe
PID 2548 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\schtasks.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2548 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2512 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

"C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bZurkfs.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bZurkfs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp407A.tmp"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

"C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\mwxejytkeimflbas"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\wzcwkiddsrekohowqmg"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\wzcwkiddsrekohowqmg"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\wzcwkiddsrekohowqmg"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\ytphkbofgzwxynkazxtlel"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\ytphkbofgzwxynkazxtlel"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\ytphkbofgzwxynkazxtlel"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\ytphkbofgzwxynkazxtlel"

Network

Country Destination Domain Proto
LV 84.38.132.126:61445 tcp
LV 84.38.132.126:61445 tcp
LV 84.38.132.126:61445 tcp
LV 84.38.132.126:61445 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

memory/2548-1-0x00000000747B0000-0x0000000074E9E000-memory.dmp

memory/2548-0-0x00000000000E0000-0x00000000001EA000-memory.dmp

memory/2548-2-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

memory/2548-3-0x0000000000460000-0x0000000000474000-memory.dmp

memory/2548-4-0x00000000005F0000-0x00000000005FA000-memory.dmp

memory/2548-5-0x0000000000600000-0x000000000060E000-memory.dmp

memory/2548-6-0x0000000007450000-0x0000000007516000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp407A.tmp

MD5 a74c62fd136aca222a10d7ceb0778550
SHA1 8cc9227127366cf2133ed32f1e4547ca7f99b36b
SHA256 d956d502f4de4501d919a3bb0df2369425389d4bf39b3fb36db001936144d6dc
SHA512 18e8c0ff6ae2ea1865f4ba9344e2ef5a3bc00fdac20c70fa06e0033b3506a4b095205f4595ccc80d4b3df5fef5c5ca5c327df0ad6640e82e7dbe5287228c4e8a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4W44A8D75E2213A4MZT4.temp

MD5 8d65f902bdfa36bd969d763af66d8840
SHA1 a3ab43f6ec982272220695700d25297d76316adb
SHA256 7892eae1d19e2fb4641ae6e0bae6b5e28010fee6db0888bc808c970aebda8b24
SHA512 81b503a502d2a67a5f04354009b0a956f4dce3da4729df1a3a962e9e078e96f1ee4c49f86d205a8991dcbf471112c87c6a77cdf8c1a1d3f485b37c7ab50fa028

memory/2512-19-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2672-22-0x000000006F300000-0x000000006F8AB000-memory.dmp

memory/2824-20-0x000000006F300000-0x000000006F8AB000-memory.dmp

memory/2512-23-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2672-24-0x0000000002AE0000-0x0000000002B20000-memory.dmp

memory/2512-27-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2672-28-0x000000006F300000-0x000000006F8AB000-memory.dmp

memory/2512-30-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2672-31-0x0000000002AE0000-0x0000000002B20000-memory.dmp

memory/2824-33-0x0000000002A00000-0x0000000002A40000-memory.dmp

memory/2672-35-0x0000000002AE0000-0x0000000002B20000-memory.dmp

memory/2512-34-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2824-26-0x000000006F300000-0x000000006F8AB000-memory.dmp

memory/2512-37-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-39-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2512-41-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-45-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-47-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2548-49-0x00000000747B0000-0x0000000074E9E000-memory.dmp

memory/2512-48-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-51-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-52-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-53-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2824-54-0x000000006F300000-0x000000006F8AB000-memory.dmp

memory/2672-55-0x000000006F300000-0x000000006F8AB000-memory.dmp

memory/2512-57-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-56-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-58-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-59-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-60-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-61-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-63-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-64-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1068-71-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2512-72-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1068-74-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1068-67-0x0000000000400000-0x0000000000478000-memory.dmp

memory/644-75-0x0000000000400000-0x0000000000457000-memory.dmp

memory/644-77-0x0000000000400000-0x0000000000457000-memory.dmp

memory/644-80-0x0000000000400000-0x0000000000457000-memory.dmp

memory/2960-82-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2960-84-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2960-85-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2960-86-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2960-87-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1068-92-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mwxejytkeimflbas

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/644-95-0x0000000000400000-0x0000000000457000-memory.dmp

memory/2512-96-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2512-100-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2512-99-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2512-101-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2512-102-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-105-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-106-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-107-0x0000000000400000-0x0000000000482000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 01858ef3d89414fe18ee21beabc2e5eb
SHA1 cb7513d082cbbb4bfba82007d60f662223f17a32
SHA256 a41db451968a627681c1153696b72e8eb9116b0b6f207ee5434b1d638c74f265
SHA512 8453dd6b4be559b203d8d9e8c3030ef457589a76eeef08a59b466e4f9eaab19fbf3a877789f3d42b4efb155a64d97ccef5a99d398895eb23871a28f4f05c999d

memory/2512-111-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2512-115-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-116-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2512-123-0x0000000000400000-0x0000000000482000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-13 02:42

Reported

2024-02-13 02:47

Platform

win10v2004-20231222-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"

Signatures

Remcos

rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2524 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2524 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\schtasks.exe
PID 2524 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\schtasks.exe
PID 2524 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Windows\SysWOW64\schtasks.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 2524 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
PID 5020 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

"C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bZurkfs.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bZurkfs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D8C.tmp"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

"C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\uwspdzixsloblboqfowiysefajfbybqxb"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\hscaekesu"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\eyxhes"

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\eyxhes"

Network

Country Destination Domain Proto
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
LV 84.38.132.126:61445 tcp
US 8.8.8.8:53 126.132.38.84.in-addr.arpa udp
LV 84.38.132.126:61445 tcp
LV 84.38.132.126:61445 tcp
LV 84.38.132.126:61445 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp

Files

memory/2524-0-0x0000000074BB0000-0x0000000075360000-memory.dmp

memory/2524-1-0x0000000000D20000-0x0000000000E2A000-memory.dmp

memory/2524-2-0x0000000008290000-0x0000000008834000-memory.dmp

memory/2524-3-0x0000000007D80000-0x0000000007E12000-memory.dmp

memory/2524-4-0x0000000005830000-0x0000000005840000-memory.dmp

memory/2524-5-0x0000000007D00000-0x0000000007D0A000-memory.dmp

memory/2524-6-0x000000000A7B0000-0x000000000A84C000-memory.dmp

memory/2524-7-0x0000000008280000-0x0000000008294000-memory.dmp

memory/2524-8-0x000000000AAF0000-0x000000000AAFA000-memory.dmp

memory/2524-9-0x000000000AB00000-0x000000000AB0E000-memory.dmp

memory/2524-10-0x000000000ABF0000-0x000000000ACB6000-memory.dmp

memory/4748-15-0x0000000004620000-0x0000000004656000-memory.dmp

memory/4748-16-0x0000000074BB0000-0x0000000075360000-memory.dmp

memory/3188-18-0x0000000002250000-0x0000000002260000-memory.dmp

memory/4748-19-0x0000000004D10000-0x0000000005338000-memory.dmp

memory/4748-20-0x00000000046D0000-0x00000000046E0000-memory.dmp

memory/3188-17-0x0000000002250000-0x0000000002260000-memory.dmp

memory/3188-21-0x0000000074BB0000-0x0000000075360000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7D8C.tmp

MD5 47fb1c5ecd59eba27ec7eef3263efe33
SHA1 ee454ef0807cab2f5e944fe4bceb6d326de42299
SHA256 2f1cdc8fa3865f426bc35355069e5985628ebe93d3d6057d92e888d721b41f96
SHA512 c8f67f08528631d4fb486178c71e4007d6278911bbc2b1bf3d08892256d483c63155ca5c6c3a595fcb70df86ec8879f32e739d08ed06f2d7ad89cd38f52787c8

memory/3188-24-0x0000000005390000-0x00000000053F6000-memory.dmp

memory/4748-23-0x0000000004B50000-0x0000000004B72000-memory.dmp

memory/2524-25-0x0000000074BB0000-0x0000000075360000-memory.dmp

memory/3188-26-0x00000000054F0000-0x0000000005556000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yw3g3rly.gaa.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4748-43-0x0000000005620000-0x0000000005974000-memory.dmp

memory/5020-42-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-41-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-49-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2524-50-0x0000000074BB0000-0x0000000075360000-memory.dmp

memory/5020-51-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-52-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3188-54-0x0000000005B30000-0x0000000005B4E000-memory.dmp

memory/5020-55-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-56-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-58-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3188-57-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

memory/3188-60-0x000000007F560000-0x000000007F570000-memory.dmp

memory/3188-63-0x0000000071370000-0x00000000713BC000-memory.dmp

memory/4748-61-0x0000000071370000-0x00000000713BC000-memory.dmp

memory/5020-75-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4748-85-0x00000000046D0000-0x00000000046E0000-memory.dmp

memory/5020-87-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4748-86-0x0000000006BE0000-0x0000000006C83000-memory.dmp

memory/5020-89-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4748-74-0x0000000006BB0000-0x0000000006BCE000-memory.dmp

memory/5020-90-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4748-62-0x000000007F550000-0x000000007F560000-memory.dmp

memory/4748-73-0x00000000046D0000-0x00000000046E0000-memory.dmp

memory/3188-59-0x0000000006B00000-0x0000000006B32000-memory.dmp

memory/5020-91-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3188-92-0x00000000074A0000-0x0000000007B1A000-memory.dmp

memory/4748-93-0x0000000006F20000-0x0000000006F3A000-memory.dmp

memory/4748-94-0x0000000006F90000-0x0000000006F9A000-memory.dmp

memory/3188-95-0x00000000070E0000-0x0000000007176000-memory.dmp

memory/3188-96-0x0000000007060000-0x0000000007071000-memory.dmp

memory/5020-98-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-100-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4748-101-0x0000000007150000-0x000000000715E000-memory.dmp

memory/4748-102-0x0000000007160000-0x0000000007174000-memory.dmp

memory/3188-104-0x00000000071A0000-0x00000000071BA000-memory.dmp

memory/4748-105-0x0000000007240000-0x0000000007248000-memory.dmp

memory/4748-103-0x0000000007260000-0x000000000727A000-memory.dmp

memory/4748-109-0x0000000074BB0000-0x0000000075360000-memory.dmp

memory/3188-108-0x0000000074BB0000-0x0000000075360000-memory.dmp

memory/3876-112-0x0000000000320000-0x0000000000320000-memory.dmp

memory/1360-114-0x0000000000400000-0x0000000000457000-memory.dmp

memory/4884-117-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1360-120-0x0000000000400000-0x0000000000457000-memory.dmp

memory/1360-128-0x0000000000400000-0x0000000000457000-memory.dmp

memory/4884-131-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4884-130-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4884-127-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1360-126-0x0000000000400000-0x0000000000457000-memory.dmp

memory/1360-122-0x0000000000400000-0x0000000000457000-memory.dmp

memory/2504-121-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2504-116-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2504-111-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2504-133-0x0000000000400000-0x0000000000478000-memory.dmp

memory/5020-139-0x0000000010000000-0x0000000010019000-memory.dmp

memory/5020-140-0x0000000010000000-0x0000000010019000-memory.dmp

memory/5020-142-0x0000000010000000-0x0000000010019000-memory.dmp

memory/5020-141-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-138-0x0000000010000000-0x0000000010019000-memory.dmp

memory/5020-135-0x0000000010000000-0x0000000010019000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\uwspdzixsloblboqfowiysefajfbybqxb

MD5 9d1c4331e92ea47959e79f26ca09d973
SHA1 f8baa65953243feba3299fbaa7af110fbc7011b2
SHA256 ffddf68859952ecc2a486189ef0b15519f898d4d1ba04f6555264714b2d9108f
SHA512 76cc4cfa6a89d69035c0539294a5903f5b9b01314aaa2ffef7ccc6a5cdc163bf2336fa98e6f5406510b74c8da8bf5cbac5c55718df58f3b082b7fe8f8dda3daf

memory/5020-144-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-146-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-147-0x0000000000400000-0x0000000000482000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 aea106b48f354d67636c9bbad32f57e0
SHA1 99ef0aef230d45632a09fc0817aaf01ba57d8f07
SHA256 c54964a19276a5e43a5d9060891d223999349e0b723606af191715d5856243e5
SHA512 4e9ef1f59d3af81590c88f47b12744fc6cddb3bafb1c02c9b1d6271c46407ad8950bbc38a1a454f9ea0e2c46f7f6475f8d32223ceb98aeedd8a06ca697ff56a6

memory/5020-154-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-155-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-162-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-163-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-170-0x0000000000400000-0x0000000000482000-memory.dmp

memory/5020-171-0x0000000000400000-0x0000000000482000-memory.dmp