Analysis Overview
SHA256
a1f0f4676e135cc88ab8b6a25c70530fa193b1718bd2ba7b6ac1c997c241f6c8
Threat Level: Known bad
The file 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded was found to be: Known bad.
Malicious Activity Summary
Remcos
Remcos family
NirSoft WebBrowserPassView
Nirsoft
NirSoft MailPassView
Accesses Microsoft Outlook accounts
Suspicious use of SetThreadContext
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-04 07:24
Signatures
Remcos family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-04 07:24
Reported
2024-04-04 07:27
Platform
win7-20240221-en
Max time kernel
148s
Max time network
152s
Command Line
Signatures
Remcos
Suspicious use of SetThreadContext
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe
"C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\eztbuxspotacihrkvzaduvhctkryauylac"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\htzuvpd"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rwemvinkqk"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wffwszsxsogsiiucgkitjbvswpgcvgruq"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\yzsht"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jbyaukot"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dimrqjaepbudhviyirwhmtwsqnly"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\okzkrblydjmijkwcrcjipgijzudhjbk"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qfeusuwzrrenuqtgbndkaldsiinqceijdi"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vogeplbetwbtixlytcwwbzjjts"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vogeplbetwbtixlytcwwbzjjts"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fqlxqdlgpetysdzccmryemeacysmwn"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fqlxqdlgpetysdzccmryemeacysmwn"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ikqpqwwadmldvrvgmxdzpqqjdnkvxybkt"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\czmhncqlqjpwhsamnkrke"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mbrrnnbnerhjryoqwuemhewaw"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xwxkofmgszzotfkunfrnsrrrflpy"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xwxkofmgszzotfkunfrnsrrrflpy"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rltblmysgvdhfghzp"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ufyulertcdwmqudlyura"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ehlmmxcnplozsarphfmbwkk"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jqeojozarqkxohr"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tkshkgkufyccrngdjm"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tkshkgkufyccrngdjm"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wmxalzuvbguhbbchsxmrk"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qttrhyphod"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bwyciqzaclqnp"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bwyciqzaclqnp"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bwyciqzaclqnp"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lqduijkcqtiszpidu"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ffzmf"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ihfegaph"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\sbkxgsajogxd"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nqgodzmubcbwklcxpjbmhjupjhzsyfo"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xklz"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\anrrecq"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | jansuri.kozow.com | udp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
Files
memory/848-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/848-2-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-4-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-6-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-5-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-7-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-8-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-9-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-10-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-11-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-12-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-14-0x0000000000080000-0x0000000000102000-memory.dmp
memory/3036-17-0x0000000000400000-0x0000000000478000-memory.dmp
memory/848-19-0x0000000000080000-0x0000000000102000-memory.dmp
memory/2948-21-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2960-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2960-24-0x0000000000400000-0x0000000000424000-memory.dmp
memory/848-52-0x0000000000080000-0x0000000000102000-memory.dmp
memory/944-56-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/848-62-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-63-0x0000000000080000-0x0000000000102000-memory.dmp
memory/848-112-0x0000000010000000-0x0000000010019000-memory.dmp
memory/848-115-0x0000000010000000-0x0000000010019000-memory.dmp
memory/848-119-0x0000000010000000-0x0000000010019000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-04 07:24
Reported
2024-04-04 07:27
Platform
win10v2004-20240226-en
Max time kernel
151s
Max time network
157s
Command Line
Signatures
Remcos
NirSoft MailPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
NirSoft WebBrowserPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Nirsoft
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Accesses Microsoft Outlook accounts
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4764 set thread context of 3508 | N/A | C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
| PID 3508 set thread context of 2964 | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
| PID 3508 set thread context of 2992 | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
| PID 3508 set thread context of 3140 | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe
"C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xfkigvxa"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hzpbhnibmqag"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hzpbhnibmqag"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kbuthgtvaystapz"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kbuthgtvaystapz"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3784 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | jansuri.kozow.com | udp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| US | 8.8.8.8:53 | 233.140.147.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| US | 8.8.8.8:53 | 202.110.86.104.in-addr.arpa | udp |
| GB | 216.58.201.106:443 | tcp | |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.33.237.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.111.86.104.in-addr.arpa | udp |
Files
memory/3508-0-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-1-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-2-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-3-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-4-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-5-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-6-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-7-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-8-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-9-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-10-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/2964-11-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3508-12-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/2992-14-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3140-16-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3508-19-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/2964-20-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2992-21-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3140-22-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3140-23-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2992-26-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3140-27-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2964-25-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2992-28-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3140-29-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2992-30-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2964-41-0x0000000000400000-0x0000000000478000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\xfkigvxa
| MD5 | 10fa8ec140c204486092fb161e567ec7 |
| SHA1 | 4d63e1f8df3afefedb19df73d7ee5f3b1e7b6473 |
| SHA256 | 7176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04 |
| SHA512 | 9db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76 |
memory/3508-43-0x0000000010000000-0x0000000010019000-memory.dmp
memory/3508-47-0x0000000010000000-0x0000000010019000-memory.dmp
memory/3508-48-0x0000000010000000-0x0000000010019000-memory.dmp
memory/3508-49-0x0000000010000000-0x0000000010019000-memory.dmp
memory/3508-50-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-51-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-52-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-53-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-54-0x0000000010000000-0x0000000010019000-memory.dmp
memory/3508-55-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-56-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-57-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-58-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-59-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-60-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-61-0x0000000000D80000-0x0000000000E02000-memory.dmp
memory/3508-62-0x0000000000D80000-0x0000000000E02000-memory.dmp