Malware Analysis Report

2024-12-07 22:28

Sample ID 240408-k1ac3sde46
Target RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
SHA256 408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c
Tags
remcos remotehost collection rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

408f6df5140e6b71b4fc5add7ae8d69f89d5aebb184081de8076e7c1972fe55c

Threat Level: Known bad

The file RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe was found to be: Known bad.

Malicious Activity Summary

remcos remotehost collection rat spyware stealer

Remcos

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Checks computer location settings

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-08 09:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 09:03

Reported

2024-04-08 09:06

Platform

win7-20240221-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"

Signatures

Remcos

rat remcos

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 112 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 112 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\schtasks.exe
PID 112 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\schtasks.exe
PID 112 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\schtasks.exe
PID 112 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\schtasks.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 112 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1604 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

Processes

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fmduzErmJdOHa.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fmduzErmJdOHa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp63C2.tmp"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\viokgylmgtyqzfvxp"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gltchqvfubqdbljbgiyd"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ifhvijghijiimzfnpstxjzil"

Network

Country Destination Domain Proto
US 8.8.8.8:53 paygateme.net udp
US 146.70.57.34:2286 paygateme.net tcp
US 146.70.57.34:2286 paygateme.net tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 146.70.57.34:2286 paygateme.net tcp
US 146.70.57.34:2286 paygateme.net tcp

Files

memory/112-0-0x0000000001190000-0x000000000128C000-memory.dmp

memory/112-1-0x0000000074CD0000-0x00000000753BE000-memory.dmp

memory/112-2-0x0000000004D00000-0x0000000004D40000-memory.dmp

memory/112-3-0x0000000000690000-0x00000000006AC000-memory.dmp

memory/112-4-0x0000000000360000-0x0000000000368000-memory.dmp

memory/112-5-0x0000000000380000-0x000000000038C000-memory.dmp

memory/112-6-0x0000000004ED0000-0x0000000004F90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp63C2.tmp

MD5 17fd0e70c58f84df1aca89d1dafe8e1e
SHA1 f5508cd032836b1626a47fdc6331ce99b2dd2e96
SHA256 a2e2d9465954a2756a8c38aeeb4d2294ce8fad2e9527bf2a5bd57b895d3dcf02
SHA512 68c9b1af161a83c37b47c02c0ed42c923a5e029e863a56f8774b302caf79b12a2c2cd54b9fc9e4c9fc9b695f9eb6df09bae8abdecf56fd16c1d8d3a001fedbbd

memory/1604-14-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-16-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-18-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-19-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-21-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-23-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-25-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-27-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1604-31-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-33-0x0000000000400000-0x0000000000482000-memory.dmp

memory/112-34-0x0000000074CD0000-0x00000000753BE000-memory.dmp

memory/1604-35-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-37-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-38-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-39-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2588-41-0x000000006F0A0000-0x000000006F64B000-memory.dmp

memory/1604-42-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2588-43-0x000000006F0A0000-0x000000006F64B000-memory.dmp

memory/2588-44-0x0000000002980000-0x00000000029C0000-memory.dmp

memory/2588-45-0x000000006F0A0000-0x000000006F64B000-memory.dmp

memory/1604-47-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-49-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-51-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-52-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2884-56-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2884-58-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2884-61-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2884-66-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2696-67-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2696-63-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2696-71-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2696-70-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1584-72-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1584-75-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1584-74-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1584-76-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1584-77-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2884-82-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\viokgylmgtyqzfvxp

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2696-85-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1604-86-0x0000000010000000-0x0000000010019000-memory.dmp

memory/1604-90-0x0000000010000000-0x0000000010019000-memory.dmp

memory/1604-89-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2588-92-0x0000000002980000-0x00000000029C0000-memory.dmp

memory/1604-91-0x0000000010000000-0x0000000010019000-memory.dmp

memory/1604-93-0x0000000010000000-0x0000000010019000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 85ea239eb267ac4f4328c34fe9f682e5
SHA1 b5619b2615998aedb13b2c651bdfa658d1d52e29
SHA256 27391626d1ca4826b55e9cf7125de2fa5b51847ca522efe853b7355b50f93bf8
SHA512 0edee93a62baed3fea037dafd11bc4f9f27f7ef15b492344d6d28c2ca973cfdd96c91ec9a23e1518628db4d31e404fe224762855cd6b0098da3e5d4990482ec5

memory/1604-95-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-96-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-99-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-100-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-102-0x0000000010000000-0x0000000010019000-memory.dmp

memory/1604-109-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-110-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-117-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-118-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-121-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-122-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1604-124-0x0000000000400000-0x0000000000482000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-08 09:03

Reported

2024-04-08 09:06

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"

Signatures

Remcos

rat remcos

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1596 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1596 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\schtasks.exe
PID 1596 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\schtasks.exe
PID 1596 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Windows\SysWOW64\schtasks.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 1596 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe
PID 544 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

Processes

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fmduzErmJdOHa.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fmduzErmJdOHa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA41F.tmp"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tlrqpmraonfnszieltkimbrhubwnjhg"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dnwaqfctcwxscfxiuwecpolycioolkffne"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dnwaqfctcwxscfxiuwecpolycioolkffne"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ohbtrx"

C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ.NO. S70-23Q-1474-CS-P - ORDER 2024.gz.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ohbtrx"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 paygateme.net udp
US 146.70.57.34:2286 paygateme.net tcp
US 8.8.8.8:53 34.57.70.146.in-addr.arpa udp
US 146.70.57.34:2286 paygateme.net tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 81.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 146.70.57.34:2286 paygateme.net tcp
US 146.70.57.34:2286 paygateme.net tcp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp

Files

memory/1596-1-0x00000000006E0000-0x00000000007DC000-memory.dmp

memory/1596-0-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/1596-2-0x0000000005620000-0x0000000005BC4000-memory.dmp

memory/1596-3-0x0000000005070000-0x0000000005102000-memory.dmp

memory/1596-4-0x00000000051D0000-0x00000000051E0000-memory.dmp

memory/1596-5-0x0000000005050000-0x000000000505A000-memory.dmp

memory/1596-6-0x00000000052D0000-0x000000000536C000-memory.dmp

memory/1596-7-0x0000000005190000-0x00000000051AC000-memory.dmp

memory/1596-8-0x00000000051B0000-0x00000000051B8000-memory.dmp

memory/1596-9-0x0000000001130000-0x000000000113C000-memory.dmp

memory/1596-10-0x0000000006090000-0x0000000006150000-memory.dmp

memory/3692-15-0x00000000028F0000-0x0000000002926000-memory.dmp

memory/3692-16-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/3692-17-0x00000000028E0000-0x00000000028F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA41F.tmp

MD5 308d3bd81494562f8221bca2ca3c6c05
SHA1 f2c42bee7dc735e34e5c8cb2dfbf76af7b44c181
SHA256 45b3772459e9825f39d7c0e904b8692bb38290145948998c2b85faa1b33342c3
SHA512 a7341f8b64b2d7436874bc2b239fea6ae86a247fc60b11011b66939f18b7b24414213ee4f9b147dd94e07884a2822bbcd99fe2b598d3f2767cf632da2ea6db4f

memory/1596-19-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/3692-20-0x0000000005530000-0x0000000005B58000-memory.dmp

memory/544-21-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3692-22-0x0000000005120000-0x0000000005142000-memory.dmp

memory/544-23-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3692-24-0x0000000005340000-0x00000000053A6000-memory.dmp

memory/544-26-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1596-33-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/3692-32-0x0000000005BD0000-0x0000000005C36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2s0a24q.gde.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3692-40-0x0000000005C40000-0x0000000005F94000-memory.dmp

memory/544-43-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-42-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-35-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-44-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-34-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-45-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3692-46-0x0000000006210000-0x000000000622E000-memory.dmp

memory/3692-48-0x00000000067C0000-0x000000000680C000-memory.dmp

memory/3692-49-0x00000000028E0000-0x00000000028F0000-memory.dmp

memory/544-50-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-51-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3692-52-0x0000000007220000-0x0000000007252000-memory.dmp

memory/3692-53-0x0000000071670000-0x00000000716BC000-memory.dmp

memory/3692-63-0x0000000006770000-0x000000000678E000-memory.dmp

memory/3692-64-0x0000000007460000-0x0000000007503000-memory.dmp

memory/544-65-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-66-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3692-67-0x0000000007B90000-0x000000000820A000-memory.dmp

memory/3692-68-0x0000000007530000-0x000000000754A000-memory.dmp

memory/3692-69-0x00000000075A0000-0x00000000075AA000-memory.dmp

memory/544-71-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3692-72-0x00000000077A0000-0x0000000007836000-memory.dmp

memory/3692-74-0x0000000007740000-0x0000000007751000-memory.dmp

memory/3692-75-0x0000000007770000-0x000000000777E000-memory.dmp

memory/3692-76-0x0000000007780000-0x0000000007794000-memory.dmp

memory/3692-77-0x0000000007880000-0x000000000789A000-memory.dmp

memory/3692-78-0x0000000007860000-0x0000000007868000-memory.dmp

memory/3692-81-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/1576-82-0x0000000000400000-0x0000000000478000-memory.dmp

memory/5076-83-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1576-86-0x0000000000400000-0x0000000000478000-memory.dmp

memory/5076-88-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2516-87-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1576-90-0x0000000000400000-0x0000000000478000-memory.dmp

memory/5076-93-0x0000000000400000-0x0000000000462000-memory.dmp

memory/5076-96-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2516-95-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2516-101-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2516-102-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1576-104-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tlrqpmraonfnszieltkimbrhubwnjhg

MD5 32a7b06ba8a0426235849b55b563b06b
SHA1 47157e4608ac7375544e6a59c7353f5bea8167f5
SHA256 14bb01cde2127abdc8cbef51092d1327d4fc63d40b47ca4621947c0dd8475e52
SHA512 0a610acf3ee1abcbb198d0d52de567d8c40d3460897ad9cb53d1a9cc463935b13c13e880b23716a429d8680794d24e1d1ecfce2f386e3861798bd03bbf1f8cf6

memory/544-106-0x0000000010000000-0x0000000010019000-memory.dmp

memory/544-109-0x0000000010000000-0x0000000010019000-memory.dmp

memory/544-110-0x0000000010000000-0x0000000010019000-memory.dmp

memory/544-111-0x0000000010000000-0x0000000010019000-memory.dmp

memory/544-113-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-112-0x0000000010000000-0x0000000010019000-memory.dmp

memory/544-114-0x0000000000400000-0x0000000000482000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 23f18db0842c2ab5d1685ce8eee3318d
SHA1 34220669e745cfccb790d351fae81eec30205707
SHA256 6bc551d9cae4031708996dea31e1f08327f43b61030f41f8d5da3d228188c89c
SHA512 43ba668e146022d51b2fb9c212229178fffc94d268cded2d976e3fc3bd75cfdadb959480bec6d595fc43a891c09a814fca76e9866451251cc8712e9b7985d835

memory/544-118-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-119-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-121-0x0000000010000000-0x0000000010019000-memory.dmp

memory/544-127-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-128-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-136-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-137-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-141-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-142-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-143-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-144-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-146-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-149-0x0000000000400000-0x0000000000482000-memory.dmp

memory/544-150-0x0000000000400000-0x0000000000482000-memory.dmp