Analysis
-
max time kernel
136s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe
Resource
win10v2004-20240226-en
General
-
Target
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe
-
Size
1.6MB
-
MD5
4e1e0180c5e140946d7970f64e644ac1
-
SHA1
e5f939a05d817a4b56ef7ec74788ad9ce3b8cb27
-
SHA256
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd
-
SHA512
f50883d44f5ccdccb9adf9cb6cc3f6c9d6947e9b0f85d7727af151424e54d1f041d3bb6238dd29f27c47ebed20ae7e74187d31b67fd285cc1aa7d28e66204954
-
SSDEEP
49152:ay6imwGhfj4GBT2z95Zw/L+gwnz1nwyuPTh:azimw4f8iSuD+g
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:44999
127.0.0.1:54991
africarem.duckdns.org:54991
africarem.duckdns.org:44999
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-R571U4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1908-2-0x0000000002EA0000-0x0000000003EA0000-memory.dmp modiloader_stage2 -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1048-105-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/1048-118-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1316-106-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/1316-114-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1316-106-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1048-105-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/1528-109-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1528-108-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1316-114-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1048-118-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
5171742.exe5171742.exepid process 2884 5171742.exe 2728 5171742.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hmzvinyr = "C:\\Users\\Public\\Hmzvinyr.url" a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exedescription pid process target process PID 1908 set thread context of 1316 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 set thread context of 1048 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 set thread context of 1528 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exepid process 1316 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe 1316 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exepid process 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exedescription pid process Token: SeDebugPrivilege 1528 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exedescription pid process target process PID 1908 wrote to memory of 2932 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2932 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2932 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2932 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2564 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2564 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2564 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2564 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2548 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2548 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2548 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 2548 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe cmd.exe PID 1908 wrote to memory of 1588 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe extrac32.exe PID 1908 wrote to memory of 1588 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe extrac32.exe PID 1908 wrote to memory of 1588 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe extrac32.exe PID 1908 wrote to memory of 1588 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe extrac32.exe PID 1908 wrote to memory of 1316 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1316 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1316 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1316 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1048 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1048 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1048 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1048 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1528 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1528 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1528 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe PID 1908 wrote to memory of 1528 1908 a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe"C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows "2⤵PID:2932
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows \System32"2⤵PID:2564
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Windows \System32\5171742.exe"2⤵PID:2548
-
C:\Windows \System32\5171742.exe"C:\Windows \System32\5171742.exe"3⤵
- Executes dropped EXE
PID:2884 -
C:\Windows \System32\5171742.exe"C:\Windows \System32\5171742.exe"3⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe C:\\Users\\Public\\Libraries\\Hmzvinyr.PIF2⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exeC:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe /stext "C:\Users\Admin\AppData\Local\Temp\jmoyzvgglcwzrcnivkdjbsbqchveszuz"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exeC:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe /stext "C:\Users\Admin\AppData\Local\Temp\tpcj"2⤵
- Accesses Microsoft Outlook accounts
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exeC:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe /stext "C:\Users\Admin\AppData\Local\Temp\djhbagj"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612