Analysis Overview
SHA256
a1f0f4676e135cc88ab8b6a25c70530fa193b1718bd2ba7b6ac1c997c241f6c8
Threat Level: Known bad
The file 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decod was found to be: Known bad.
Malicious Activity Summary
Remcos
Remcos family
NirSoft WebBrowserPassView
Nirsoft
NirSoft MailPassView
Accesses Microsoft Outlook accounts
Suspicious use of SetThreadContext
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-04 07:24
Signatures
Remcos family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-04 07:24
Reported
2024-04-04 07:27
Platform
win7-20240221-en
Max time kernel
147s
Max time network
142s
Command Line
Signatures
Remcos
NirSoft MailPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
NirSoft WebBrowserPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Nirsoft
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Accesses Microsoft Outlook accounts
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2276 set thread context of 1544 | N/A | C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
| PID 1544 set thread context of 2668 | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
| PID 1544 set thread context of 2696 | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
| PID 1544 set thread context of 2868 | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe
"C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\edwtoidblhwahesvzehviff"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pxblpbnczpofksgzqhcplkrcnb"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pxblpbnczpofksgzqhcplkrcnb"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zsgeqtywnxgsuzcdzroqwxmloiwtoe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | jansuri.kozow.com | udp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
Files
memory/1544-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1544-2-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-4-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-5-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-6-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-7-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-8-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-9-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-10-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-11-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-12-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-14-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-15-0x0000000000080000-0x0000000000102000-memory.dmp
memory/2696-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2696-22-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2868-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2668-18-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2668-27-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2668-32-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2868-35-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2696-33-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2868-31-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2668-30-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2696-28-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2868-26-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2868-36-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2668-41-0x0000000000400000-0x0000000000478000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\edwtoidblhwahesvzehviff
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
memory/2696-43-0x0000000000400000-0x0000000000462000-memory.dmp
memory/1544-44-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1544-48-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1544-47-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1544-49-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1544-50-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-51-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-52-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-53-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-54-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1544-55-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-57-0x0000000000080000-0x0000000000102000-memory.dmp
memory/1544-58-0x0000000000080000-0x0000000000102000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-04 07:24
Reported
2024-04-04 07:27
Platform
win10v2004-20240226-en
Max time kernel
150s
Max time network
151s
Command Line
Signatures
Remcos
NirSoft MailPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
NirSoft WebBrowserPassView
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Nirsoft
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Accesses Microsoft Outlook accounts
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3768 set thread context of 1096 | N/A | C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
| PID 1096 set thread context of 876 | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
| PID 1096 set thread context of 2244 | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
| PID 1096 set thread context of 3284 | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | \??\c:\program files (x86)\internet explorer\iexplore.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
| N/A | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | \??\c:\program files (x86)\internet explorer\iexplore.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe
"C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.exe"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ryyenaqldsmn"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ryyenaqldsmn"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uadxosafraeaytc"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uadxosafraeaytc"
\??\c:\program files (x86)\internet explorer\iexplore.exe
"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\euihollgniwfjzzynzz"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | jansuri.kozow.com | udp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| US | 8.8.8.8:53 | 233.140.147.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| UA | 194.147.140.233:7232 | jansuri.kozow.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| US | 8.8.8.8:53 | 50.33.237.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 13.107.253.64:443 | tcp | |
| US | 8.8.8.8:53 | 24.66.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.33.115.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.73.42.20.in-addr.arpa | udp |
Files
memory/1096-0-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-1-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-2-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-3-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-4-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-5-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-6-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-7-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-8-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-9-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-10-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-12-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-13-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/876-14-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2244-16-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3284-17-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2244-20-0x0000000000400000-0x0000000000462000-memory.dmp
memory/876-21-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3284-22-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2244-24-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3284-27-0x0000000000400000-0x0000000000424000-memory.dmp
memory/876-26-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3284-28-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2244-29-0x0000000000400000-0x0000000000462000-memory.dmp
memory/876-25-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3284-30-0x0000000000400000-0x0000000000424000-memory.dmp
memory/876-41-0x0000000000400000-0x0000000000478000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ryyenaqldsmn
| MD5 | 10fa8ec140c204486092fb161e567ec7 |
| SHA1 | 4d63e1f8df3afefedb19df73d7ee5f3b1e7b6473 |
| SHA256 | 7176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04 |
| SHA512 | 9db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76 |
memory/1096-43-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1096-46-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1096-47-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1096-48-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1096-49-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-50-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-51-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-52-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-53-0x0000000010000000-0x0000000010019000-memory.dmp
memory/1096-54-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-55-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-56-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-57-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-58-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-59-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-60-0x0000000000760000-0x00000000007E2000-memory.dmp
memory/1096-61-0x0000000000760000-0x00000000007E2000-memory.dmp