remcos | 554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
Size

966KB
MD5

9beaec299e48eb0072fd6e270d8e8cd3
SHA1

a719b69d48a210af3749bccd27b4ad5185c35d8d
SHA256

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0
SHA512

d0742bee412db3abdb8ddee99ceaf45721f6c72c2b9044838d755b6e8a51377831177eb087f709efee31dc36871e2e274338734731e3d89519bebfb1e74c0733
SSDEEP

24576:dtHKWYHu2k6ei445zcNjNGbr3SN2jcjR11O7Akmla:7KWYHu2kf745zCa3SN2jcjRuUkK

Score

10^/10

remcos buddy collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

BUDDY

192.210.201.57:52499

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LMLI87
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 23 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4988-11-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-12-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-13-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-16-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-17-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-19-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-20-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-21-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-22-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-23-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-24-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-25-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-43-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-50-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-51-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-88-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-91-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-99-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-100-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-107-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-108-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-115-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4988-116-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables built or packed with MPress PE compressor 21 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4536-26-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/5016-29-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1988-27-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1988-31-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4536-32-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4536-33-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4536-34-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1988-36-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1988-41-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3160-61-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/420-66-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3160-67-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/420-69-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4536-72-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/420-78-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4440-80-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4988-82-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4988-85-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4988-86-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4988-87-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4988-97-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables packed with SmartAssembly 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2236-6-0x0000000005E60000-0x0000000005E70000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2236-7-0x0000000006B00000-0x0000000006B0C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1988-36-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/1988-41-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/3160-67-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1988-36-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/1988-41-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/3160-67-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/1988-36-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/1988-41-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/3160-67-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/4536-34-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4536-72-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4440-80-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4536-34-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1988-36-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1988-41-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3160-67-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/420-69-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4536-72-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/420-78-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4440-80-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

Processes:

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

description	pid	process	target process
PID 2236 set thread context of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 set thread context of 4536	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 set thread context of 1988	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 set thread context of 5016	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 set thread context of 4440	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 set thread context of 3160	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 set thread context of 420	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2680 5016 WerFault.exe 554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

pid	pid_target	process	target process
2680	5016	WerFault.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

pid	process
4536	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4536	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4536	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4536	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4440	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4440	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4440	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4440	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
420	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
420	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

pid	process
4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

description pid process

Token: SeDebugPrivilege 420 554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

pid process

4988 554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

pid process

5016 554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

description	pid	process
Token: SeDebugPrivilege	420	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

pid	process
5016	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
"C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
"C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\mjlbefdzdcrqwpbiqvy"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4536

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\wdqmexobrkjdzvpmaflrvc"
3⤵
PID:4464

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\wdqmexobrkjdzvpmaflrvc"
3⤵
- Accesses Microsoft Outlook accounts
PID:1988

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\zfvefqyufsbijjlyrqytypoux"
3⤵
- Suspicious use of UnmapMainImage
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 12
4⤵
- Program crash
PID:2680

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\eowocpwigxxgxqdib"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\ojkhdzgbufpliwsmlqlhb"
3⤵
PID:2336

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\ojkhdzgbufpliwsmlqlhb"
3⤵
- Accesses Microsoft Outlook accounts
PID:3160

C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
C:\Users\Admin\AppData\Local\Temp\554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\qlpreszdqnhykloqcagimubk"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 5016
1⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3916 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:940

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
0e6994c6837b4f56b3f3ffaf5933bd14

SHA1
835b00d9774f2b8d933b881e951c37b6d19e6d3b

SHA256
0c2f182defe1496992207c3ef49cf43ca36ac8df59bd317bd109ed248835920e

SHA512
b9323647c76bca0c5eb3df1805f0b749b7d97f5fdceb74898331b0a684287f28403053f9b1367133efa18d5b1bb6221d58a0fbdcc8c5a845f475ed6084bc2561

Download Submit
C:\Users\Admin\AppData\Local\Temp\eowocpwigxxgxqdib
Filesize
4KB

MD5
10fa8ec140c204486092fb161e567ec7

SHA1
4d63e1f8df3afefedb19df73d7ee5f3b1e7b6473

SHA256
7176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04

SHA512
9db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76

Download Submit
memory/420-66-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/420-69-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/420-78-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1988-31-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1988-36-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1988-41-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1988-27-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2236-8-0x0000000006FE0000-0x00000000070A0000-memory.dmp

Filesize
768KB

Download
memory/2236-7-0x0000000006B00000-0x0000000006B0C000-memory.dmp

Filesize
48KB

Download
memory/2236-2-0x0000000005E70000-0x0000000006414000-memory.dmp

Filesize
5.6MB

Download
memory/2236-9-0x0000000009680000-0x000000000971C000-memory.dmp

Filesize
624KB

Download
memory/2236-4-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/2236-10-0x00000000747D0000-0x0000000074F80000-memory.dmp

Filesize
7.7MB

Download
memory/2236-3-0x00000000058C0000-0x0000000005952000-memory.dmp

Filesize
584KB

Download
memory/2236-15-0x00000000747D0000-0x0000000074F80000-memory.dmp

Filesize
7.7MB

Download
memory/2236-1-0x0000000000D80000-0x0000000000E76000-memory.dmp

Filesize
984KB

Download
memory/2236-6-0x0000000005E60000-0x0000000005E70000-memory.dmp

Filesize
64KB

Download
memory/2236-0-0x00000000747D0000-0x0000000074F80000-memory.dmp

Filesize
7.7MB

Download
memory/2236-5-0x0000000005890000-0x000000000589A000-memory.dmp

Filesize
40KB

Download
memory/3160-61-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3160-67-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4440-80-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4536-32-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4536-33-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4536-26-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4536-72-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4536-34-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4988-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-82-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4988-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-116-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-85-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4988-86-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4988-87-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4988-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-115-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-91-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-97-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4988-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-100-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4988-108-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5016-90-0x0000000000380000-0x0000000000380000-memory.dmp

Download
memory/5016-29-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

description	pid	process	target process
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 2236 wrote to memory of 4988	2236	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4536	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4536	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4536	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4536	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4464	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4464	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4464	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 1988	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 1988	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 1988	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 1988	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 5016	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 5016	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 5016	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 5016	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4440	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4440	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4440	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 4440	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 2336	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 2336	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 2336	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 3160	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 3160	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 3160	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 3160	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 420	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 420	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 420	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe
PID 4988 wrote to memory of 420	4988	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe	554b40336bad24df88cbde544cdf20d553d02ce7fee5dab9a82318d7c21471e0.exe