Malware Analysis Report

2025-01-02 03:13

Sample ID 240404-h8ld7shg98
Target 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded
SHA256 a1f0f4676e135cc88ab8b6a25c70530fa193b1718bd2ba7b6ac1c997c241f6c8
Tags
remotehost remcos rat collection
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a1f0f4676e135cc88ab8b6a25c70530fa193b1718bd2ba7b6ac1c997c241f6c8

Threat Level: Known bad

The file 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded was found to be: Known bad.

Malicious Activity Summary

remotehost remcos rat collection

Remcos

Remcos family

NirSoft WebBrowserPassView

Nirsoft

NirSoft MailPassView

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-04 07:24

Signatures

Remcos family

remcos

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-04 07:24

Reported

2024-04-04 07:27

Platform

win7-20240221-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe"

Signatures

Remcos

rat remcos

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2076 set thread context of 848 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 3036 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2948 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2960 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2596 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2632 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2540 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 1296 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2552 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2576 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2504 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2448 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 1576 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 1888 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 944 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 1736 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 1652 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2344 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2220 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 1812 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2208 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 816 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 1784 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 476 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 668 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2740 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2720 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 3052 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2944 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 2232 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 set thread context of 1600 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2076 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2076 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2076 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2076 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2076 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 3036 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 3036 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 3036 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 3036 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 3036 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2948 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2948 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2948 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2948 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2948 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2960 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2960 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2960 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2960 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2960 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2596 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2596 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2596 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2596 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2596 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2632 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2632 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2632 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2632 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2632 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2540 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2540 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2540 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2540 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2540 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 1296 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 1296 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 1296 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 1296 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 1296 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2552 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2552 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2552 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2552 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2552 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2576 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2576 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2576 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2576 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2576 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2456 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2456 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2456 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2456 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2504 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2504 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2504 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2504 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2504 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2848 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2848 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2848 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2848 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 848 wrote to memory of 2448 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe

"C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\eztbuxspotacihrkvzaduvhctkryauylac"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\htzuvpd"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rwemvinkqk"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wffwszsxsogsiiucgkitjbvswpgcvgruq"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\yzsht"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jbyaukot"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dimrqjaepbudhviyirwhmtwsqnly"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\okzkrblydjmijkwcrcjipgijzudhjbk"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qfeusuwzrrenuqtgbndkaldsiinqceijdi"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vogeplbetwbtixlytcwwbzjjts"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vogeplbetwbtixlytcwwbzjjts"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fqlxqdlgpetysdzccmryemeacysmwn"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fqlxqdlgpetysdzccmryemeacysmwn"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ikqpqwwadmldvrvgmxdzpqqjdnkvxybkt"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\czmhncqlqjpwhsamnkrke"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mbrrnnbnerhjryoqwuemhewaw"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xwxkofmgszzotfkunfrnsrrrflpy"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xwxkofmgszzotfkunfrnsrrrflpy"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rltblmysgvdhfghzp"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ufyulertcdwmqudlyura"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ehlmmxcnplozsarphfmbwkk"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jqeojozarqkxohr"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tkshkgkufyccrngdjm"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tkshkgkufyccrngdjm"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wmxalzuvbguhbbchsxmrk"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qttrhyphod"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bwyciqzaclqnp"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bwyciqzaclqnp"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bwyciqzaclqnp"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lqduijkcqtiszpidu"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ffzmf"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ihfegaph"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\sbkxgsajogxd"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nqgodzmubcbwklcxpjbmhjupjhzsyfo"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xklz"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\anrrecq"

Network

Country Destination Domain Proto
US 8.8.8.8:53 jansuri.kozow.com udp
UA 194.147.140.233:7232 jansuri.kozow.com tcp
UA 194.147.140.233:7232 jansuri.kozow.com tcp
UA 194.147.140.233:7232 jansuri.kozow.com tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

memory/848-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/848-2-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-4-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-6-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-5-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-7-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-8-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-9-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-10-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-11-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-12-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-14-0x0000000000080000-0x0000000000102000-memory.dmp

memory/3036-17-0x0000000000400000-0x0000000000478000-memory.dmp

memory/848-19-0x0000000000080000-0x0000000000102000-memory.dmp

memory/2948-21-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2960-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2960-24-0x0000000000400000-0x0000000000424000-memory.dmp

memory/848-52-0x0000000000080000-0x0000000000102000-memory.dmp

memory/944-56-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/848-62-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-63-0x0000000000080000-0x0000000000102000-memory.dmp

memory/848-112-0x0000000010000000-0x0000000010019000-memory.dmp

memory/848-115-0x0000000010000000-0x0000000010019000-memory.dmp

memory/848-119-0x0000000010000000-0x0000000010019000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-04 07:24

Reported

2024-04-04 07:27

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe"

Signatures

Remcos

rat remcos

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4764 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 4764 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 4764 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 4764 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 2964 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 2964 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 2964 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 2964 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 4596 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 4596 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 4596 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 2992 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 2992 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 2992 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 2992 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 3568 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 3568 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 3568 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 3140 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 3140 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 3140 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 3508 wrote to memory of 3140 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe \??\c:\program files (x86)\internet explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe

"C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xfkigvxa"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hzpbhnibmqag"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hzpbhnibmqag"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kbuthgtvaystapz"

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kbuthgtvaystapz"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3784 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 jansuri.kozow.com udp
UA 194.147.140.233:7232 jansuri.kozow.com tcp
US 8.8.8.8:53 233.140.147.194.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
UA 194.147.140.233:7232 jansuri.kozow.com tcp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
GB 216.58.201.106:443 tcp
UA 194.147.140.233:7232 jansuri.kozow.com tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 160.111.86.104.in-addr.arpa udp

Files

memory/3508-0-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-1-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-2-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-3-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-4-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-5-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-6-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-7-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-8-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-9-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-10-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/2964-11-0x0000000000400000-0x0000000000478000-memory.dmp

memory/3508-12-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/2992-14-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3140-16-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3508-19-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/2964-20-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2992-21-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3140-22-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3140-23-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2992-26-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3140-27-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2964-25-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2992-28-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3140-29-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2992-30-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2964-41-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xfkigvxa

MD5 10fa8ec140c204486092fb161e567ec7
SHA1 4d63e1f8df3afefedb19df73d7ee5f3b1e7b6473
SHA256 7176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04
SHA512 9db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76

memory/3508-43-0x0000000010000000-0x0000000010019000-memory.dmp

memory/3508-47-0x0000000010000000-0x0000000010019000-memory.dmp

memory/3508-48-0x0000000010000000-0x0000000010019000-memory.dmp

memory/3508-49-0x0000000010000000-0x0000000010019000-memory.dmp

memory/3508-50-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-51-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-52-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-53-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-54-0x0000000010000000-0x0000000010019000-memory.dmp

memory/3508-55-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-56-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-57-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-58-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-59-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-60-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-61-0x0000000000D80000-0x0000000000E02000-memory.dmp

memory/3508-62-0x0000000000D80000-0x0000000000E02000-memory.dmp