Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 02:32
Static task
static1
Behavioral task
behavioral1
Sample
ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe
Resource
win10v2004-20240412-en
General
-
Target
ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe
-
Size
1.3MB
-
MD5
69eaab67fd89a7dca0de1a2405d0df34
-
SHA1
e1d55aca4c9c6edce5a1301f678f09826af3670e
-
SHA256
ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0
-
SHA512
7c132d714c08a59d12f57f6b18669577a506398a87a9a050306a271c4be81975228d3e80a08ad7ba2d5cff1dd87ea7fff90ee3216b6cbaa009733930d5943140
-
SSDEEP
24576:nAHnh+eWsN3skA4RV1Hom2KXMmHap7d4DajNV+zfKw6F5E1ZkDhJFa5:ah+ZkldoPK8Yapu+35qSDh8
Malware Config
Extracted
remcos
RemoteHost
sub.thisisnot2abuse.xyz:2080
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PVWWU4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
agenttesla
https://api.telegram.org/bot7124146126:AAGAbs9iw3XzfgH3tTN58djGN81AnAy9t-E/
https://api.telegram.org/bot5641014861:AAEm_7YGp9cbvOBbk5wT5BYfwW_Yl2L8a9Q/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/5024-51-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/5024-58-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4884-50-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4884-52-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4884-90-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4884-50-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/5024-51-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/4884-52-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/5024-58-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/5064-59-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/5064-62-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4884-90-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
MINEOr.exeCOMddd.exepid process 1008 MINEOr.exe 2500 COMddd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exesvchost.exedescription pid process target process PID 1676 set thread context of 2504 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe svchost.exe PID 2504 set thread context of 4884 2504 svchost.exe svchost.exe PID 2504 set thread context of 5024 2504 svchost.exe svchost.exe PID 2504 set thread context of 5064 2504 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
svchost.exesvchost.exeCOMddd.exeMINEOr.exepid process 4884 svchost.exe 4884 svchost.exe 5064 svchost.exe 5064 svchost.exe 4884 svchost.exe 4884 svchost.exe 2500 COMddd.exe 2500 COMddd.exe 1008 MINEOr.exe 1008 MINEOr.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exeef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exesvchost.exepid process 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe 2504 svchost.exe 2504 svchost.exe 2504 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
svchost.exeCOMddd.exeMINEOr.exedescription pid process Token: SeDebugPrivilege 5064 svchost.exe Token: SeDebugPrivilege 2500 COMddd.exe Token: SeDebugPrivilege 1008 MINEOr.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exeef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exepid process 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exeef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exepid process 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exeef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exesvchost.exedescription pid process target process PID 5016 wrote to memory of 2472 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe svchost.exe PID 5016 wrote to memory of 2472 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe svchost.exe PID 5016 wrote to memory of 2472 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe svchost.exe PID 5016 wrote to memory of 1676 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe PID 5016 wrote to memory of 1676 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe PID 5016 wrote to memory of 1676 5016 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe PID 1676 wrote to memory of 2504 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe svchost.exe PID 1676 wrote to memory of 2504 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe svchost.exe PID 1676 wrote to memory of 2504 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe svchost.exe PID 1676 wrote to memory of 2504 1676 ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe svchost.exe PID 2504 wrote to memory of 4884 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 4884 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 4884 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 4884 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 5024 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 5024 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 5024 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 5024 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 5064 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 5064 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 5064 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 5064 2504 svchost.exe svchost.exe PID 2504 wrote to memory of 1008 2504 svchost.exe MINEOr.exe PID 2504 wrote to memory of 1008 2504 svchost.exe MINEOr.exe PID 2504 wrote to memory of 1008 2504 svchost.exe MINEOr.exe PID 2504 wrote to memory of 2500 2504 svchost.exe COMddd.exe PID 2504 wrote to memory of 2500 2504 svchost.exe COMddd.exe PID 2504 wrote to memory of 2500 2504 svchost.exe COMddd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe"C:\Users\Admin\AppData\Local\Temp\ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe"2⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe"C:\Users\Admin\AppData\Local\Temp\ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\ef413eb1c49ca9cda1220c73b5f95138015c5d0e44d49589ae717def16af6ec0.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\kgpi"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4884 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\uiubsrk"4⤵
- Accesses Microsoft Outlook accounts
PID:5024 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\wcattjuctoc"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\MINEOr.exe"C:\Users\Admin\AppData\Local\Temp\MINEOr.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\COMddd.exe"C:\Users\Admin\AppData\Local\Temp\COMddd.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AnglophileFilesize
29KB
MD5e8991bf2bca0fe104b3528232fc91529
SHA17f1e768a257869db6d95299db0274905a94236cf
SHA256431de39c1fedad4064f0021c9c8e0ad762717ea96e1b0243a456c4bd8b125167
SHA51254ef5fe9ee73c622d4a74ba6c15bcb87124ce327cfe58a3af8c6db2c3118d608e5372d451563b5302ec377104b80d2d207e7346d0aa884903292e28a1a8ee3a3
-
C:\Users\Admin\AppData\Local\Temp\COMddd.exeFilesize
234KB
MD5b8bf53bd1b6236e6e4e1de037830802c
SHA1a8b9be18347a91bf7d4acaf08fb910a533084620
SHA25650efb12a800e55214863400a9c791d3675569f605e91098cad8f6d0d158a0d41
SHA512ac6e5cb49de3940ff1cfaf836bc217d5e3a694cc9bace130fcb3d6bf58cd94635f5ee22acba20c9d054c4e002e73f31bd0f496ab5f1854bcc323d23f2f710dbc
-
C:\Users\Admin\AppData\Local\Temp\MINEOr.exeFilesize
237KB
MD5a46d418f60ad2ba7a8d579607a5b2ba6
SHA1eca362a36a86322b2f8da228f363b98d7083095b
SHA256f67b6a804a2712d92aa67b499c8434ae8c5193d4b598470eba9dd9ff181c83da
SHA512600725e4208c0efb599e80d678b7d5532c3bad6057c3a6d891b764ce2bcc582e43e94a556d25eb8b91455c2987b56e3f497c2c5d902960033e512900eebbe230
-
C:\Users\Admin\AppData\Local\Temp\kgpiFilesize
4KB
MD5f97c396687d09448bccf0c3c470beb25
SHA1fb14d5b945f3ca0d304750530ae583860940aaeb
SHA2561e8fe5b750c0b577cfe7732e87fe963547deea8ac3ca24410e32a9066ebd7f5b
SHA51257b9d7d9d6593df68e84e01a6974b88a382284626397b4cbb0d08257d29d6715347024e0968b052e97d45233f90d608cfb448285064efa62e9fcd3bb583d1e0c
-
C:\Users\Admin\AppData\Local\Temp\unhelpableMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1008-111-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/1008-108-0x00000000732C0000-0x0000000073A70000-memory.dmpFilesize
7.7MB
-
memory/1008-103-0x0000000005DC0000-0x0000000005E5C000-memory.dmpFilesize
624KB
-
memory/1008-95-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/1008-86-0x0000000000360000-0x00000000003A2000-memory.dmpFilesize
264KB
-
memory/1008-84-0x00000000732C0000-0x0000000073A70000-memory.dmpFilesize
7.7MB
-
memory/2500-102-0x0000000006470000-0x00000000064C0000-memory.dmpFilesize
320KB
-
memory/2500-106-0x0000000006E50000-0x0000000006E5A000-memory.dmpFilesize
40KB
-
memory/2500-110-0x0000000005680000-0x0000000005690000-memory.dmpFilesize
64KB
-
memory/2500-109-0x00000000732C0000-0x0000000073A70000-memory.dmpFilesize
7.7MB
-
memory/2500-105-0x0000000006EA0000-0x0000000006F32000-memory.dmpFilesize
584KB
-
memory/2500-91-0x0000000005680000-0x0000000005690000-memory.dmpFilesize
64KB
-
memory/2500-92-0x00000000057B0000-0x0000000005816000-memory.dmpFilesize
408KB
-
memory/2500-88-0x0000000005C60000-0x0000000006204000-memory.dmpFilesize
5.6MB
-
memory/2500-87-0x00000000732C0000-0x0000000073A70000-memory.dmpFilesize
7.7MB
-
memory/2500-85-0x0000000000DB0000-0x0000000000DF0000-memory.dmpFilesize
256KB
-
memory/2504-26-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-118-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-119-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-98-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2504-117-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-116-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-115-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-31-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-114-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-71-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-30-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-48-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-29-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-28-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-83-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-113-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-112-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-99-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2504-23-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-27-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-33-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-94-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2504-34-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-24-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-107-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-101-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2504-100-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-32-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-25-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-104-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2504-37-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4884-43-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4884-52-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4884-38-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4884-90-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4884-50-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/5016-10-0x0000000003F00000-0x0000000003F04000-memory.dmpFilesize
16KB
-
memory/5024-44-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/5024-51-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/5024-39-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/5024-58-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/5064-42-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5064-62-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5064-59-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5064-53-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB