Analysis Overview
SHA256
0986af462eaf8a1a2fd770259b663e0c82539764fc49f03755a0a8034e239231
Threat Level: Known bad
The file xw8oKxLrOnt6.exe was found to be: Known bad.
Malicious Activity Summary
Remcos family
Unsigned PE
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-04-09 22:50
Signatures
Remcos family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-09 22:50
Reported
2024-04-09 22:53
Platform
win10v2004-20240226-en
Max time kernel
162s
Max time network
177s
Command Line
Signatures
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xw8oKxLrOnt6.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\xw8oKxLrOnt6.exe
"C:\Users\Admin\AppData\Local\Temp\xw8oKxLrOnt6.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | asegurar100.4cloud.click | udp |
| SE | 46.246.14.10:8888 | asegurar100.4cloud.click | tcp |
| US | 8.8.8.8:53 | 10.14.246.46.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
| US | 8.8.8.8:53 | 50.33.237.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 122.10.44.20.in-addr.arpa | udp |
Files
C:\ProgramData\remcos\logs.dat
| MD5 | f8d7412cc8eaf2e46b7a8e75a22e18f7 |
| SHA1 | a063786cefa7b85134672d69e9ac826d11a07ff1 |
| SHA256 | 5041eafa3adf09cfbf2270ea15bbf0df82bb847b45b9bd1469d74ae8ccd4f932 |
| SHA512 | 36986ee1cdd5d55a5525dda843952f9f2c937a739ad09aaf9484364dff1467c34dc26441b04390fb2b7c3ee964d3d9e006f2d54c6bc8a8a5cb12fa60d3f5ec9b |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-09 22:50
Reported
2024-04-09 22:52
Platform
win7-20240221-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xw8oKxLrOnt6.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\xw8oKxLrOnt6.exe
"C:\Users\Admin\AppData\Local\Temp\xw8oKxLrOnt6.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | asegurar100.4cloud.click | udp |
| SE | 46.246.14.10:8888 | asegurar100.4cloud.click | tcp |
| US | 8.8.8.8:53 | geoplugin.net | udp |
| NL | 178.237.33.50:80 | geoplugin.net | tcp |
Files
C:\ProgramData\remcos\logs.dat
| MD5 | fb69e4cbc35193ec553a5a0a1869b65d |
| SHA1 | 9a14bdd68783b5c2d53865017bfadfde54f32291 |
| SHA256 | 4c1c236a9e2029f28e2c8f87b7224327641c991583efb204422aa20149144fdb |
| SHA512 | bb3a0d4c38947cbed7b374654cbaecf8266f2913479ae0902b5075ae9b5d91b598d33993238e376658bc0338b9e1995e86f9d4ec9782cc6b99df85f8ca725812 |