Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 09:16
Static task
static1
Behavioral task
behavioral1
Sample
873fb22d93c231e49477c051c6438c28.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
873fb22d93c231e49477c051c6438c28.exe
Resource
win10v2004-20240226-en
General
-
Target
873fb22d93c231e49477c051c6438c28.exe
-
Size
1.3MB
-
MD5
873fb22d93c231e49477c051c6438c28
-
SHA1
ff18a1f60a255d63bd2a6f7e927bf7341bb1bb02
-
SHA256
13a780d9b9243d3fea7a8f28655b9c3cc752e39fa7ade991ef73e4f89e7b6c26
-
SHA512
9955adf3bd77ec8e79e2171a0e7f8e6ba98e4f910641a8ee56f278d66832cd00312c1c765fffbf8956fca46604a31f6942f8b51eabcc3146b4fd5a2217f943f7
-
SSDEEP
24576:kaXk+nGvZEePw/+xKgVV3PgirOpaGL5i9AO/JV8m0R:r/GjZBFP1Gk/8b
Malware Config
Extracted
remcos
RemoteHost
64.188.22.11:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-10FYXY
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3120-34-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/3120-32-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/3120-42-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3036-31-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/3036-33-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/3036-51-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/3036-31-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/3120-34-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/3036-33-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/3120-32-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/3956-43-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/3120-42-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/3036-51-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
873fb22d93c231e49477c051c6438c28.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 873fb22d93c231e49477c051c6438c28.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
873fb22d93c231e49477c051c6438c28.exe873fb22d93c231e49477c051c6438c28.exedescription pid process target process PID 3312 set thread context of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 set thread context of 3036 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 set thread context of 3120 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 set thread context of 3956 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
873fb22d93c231e49477c051c6438c28.exe873fb22d93c231e49477c051c6438c28.exepid process 3036 873fb22d93c231e49477c051c6438c28.exe 3036 873fb22d93c231e49477c051c6438c28.exe 3956 873fb22d93c231e49477c051c6438c28.exe 3956 873fb22d93c231e49477c051c6438c28.exe 3036 873fb22d93c231e49477c051c6438c28.exe 3036 873fb22d93c231e49477c051c6438c28.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
873fb22d93c231e49477c051c6438c28.exepid process 4220 873fb22d93c231e49477c051c6438c28.exe 4220 873fb22d93c231e49477c051c6438c28.exe 4220 873fb22d93c231e49477c051c6438c28.exe 4220 873fb22d93c231e49477c051c6438c28.exe 4220 873fb22d93c231e49477c051c6438c28.exe 4220 873fb22d93c231e49477c051c6438c28.exe 4220 873fb22d93c231e49477c051c6438c28.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
873fb22d93c231e49477c051c6438c28.exedescription pid process Token: SeDebugPrivilege 3956 873fb22d93c231e49477c051c6438c28.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
873fb22d93c231e49477c051c6438c28.exe873fb22d93c231e49477c051c6438c28.exedescription pid process target process PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 3312 wrote to memory of 4220 3312 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3036 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3036 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3036 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3036 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3456 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3456 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3456 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3924 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3924 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3924 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3120 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3120 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3120 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3120 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 4648 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 4648 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 4648 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 5048 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 5048 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 5048 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3956 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3956 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3956 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe PID 4220 wrote to memory of 3956 4220 873fb22d93c231e49477c051c6438c28.exe 873fb22d93c231e49477c051c6438c28.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe"C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe"C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exeC:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe /stext "C:\Users\Admin\AppData\Local\Temp\bityzyvpadnqvnnqrszizctcmnzqq"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exeC:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe /stext "C:\Users\Admin\AppData\Local\Temp\lcyrarfjwlfvgtbuacmjcgntntjzrwor"3⤵
-
C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exeC:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe /stext "C:\Users\Admin\AppData\Local\Temp\lcyrarfjwlfvgtbuacmjcgntntjzrwor"3⤵
-
C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exeC:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe /stext "C:\Users\Admin\AppData\Local\Temp\lcyrarfjwlfvgtbuacmjcgntntjzrwor"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exeC:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe /stext "C:\Users\Admin\AppData\Local\Temp\owlk"3⤵
-
C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exeC:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe /stext "C:\Users\Admin\AppData\Local\Temp\owlk"3⤵
-
C:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exeC:\Users\Admin\AppData\Local\Temp\873fb22d93c231e49477c051c6438c28.exe /stext "C:\Users\Admin\AppData\Local\Temp\owlk"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bityzyvpadnqvnnqrszizctcmnzqqFilesize
4KB
MD510fa8ec140c204486092fb161e567ec7
SHA14d63e1f8df3afefedb19df73d7ee5f3b1e7b6473
SHA2567176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04
SHA5129db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76
-
memory/3036-33-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3036-31-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3036-28-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3036-25-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3036-51-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3120-32-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3120-30-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3120-27-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3120-34-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3120-42-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3312-18-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/3312-2-0x00000000059D0000-0x0000000005F74000-memory.dmpFilesize
5.6MB
-
memory/3312-3-0x0000000005520000-0x00000000055B2000-memory.dmpFilesize
584KB
-
memory/3312-11-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/3312-1-0x00000000009F0000-0x0000000000B38000-memory.dmpFilesize
1.3MB
-
memory/3312-10-0x0000000008940000-0x0000000008A26000-memory.dmpFilesize
920KB
-
memory/3312-7-0x00000000059A0000-0x00000000059B8000-memory.dmpFilesize
96KB
-
memory/3312-8-0x00000000059C0000-0x00000000059CE000-memory.dmpFilesize
56KB
-
memory/3312-0-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/3312-12-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/3312-6-0x0000000005800000-0x000000000589C000-memory.dmpFilesize
624KB
-
memory/3312-5-0x00000000055E0000-0x00000000055EA000-memory.dmpFilesize
40KB
-
memory/3312-9-0x0000000006270000-0x0000000006284000-memory.dmpFilesize
80KB
-
memory/3312-4-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/3956-41-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3956-43-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3956-35-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4220-13-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-24-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-23-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-22-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-21-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-37-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-20-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-19-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-17-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-16-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-14-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-53-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/4220-56-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/4220-57-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/4220-58-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-59-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-60-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-61-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-62-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-63-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-64-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-65-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-67-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4220-66-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB