Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 02:38
Static task
static1
Behavioral task
behavioral1
Sample
HSBC PAYMENT CONFIRMATION COPY.PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
HSBC PAYMENT CONFIRMATION COPY.PDF.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Raasejlenes106.app
Resource
macos-20240410-en
General
-
Target
HSBC PAYMENT CONFIRMATION COPY.PDF.exe
-
Size
692KB
-
MD5
904ff58ae02442b30663c9be0f4d9e77
-
SHA1
9009f89ab55e84c8bbf70303247c62f8048deb77
-
SHA256
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5
-
SHA512
46aceab3cd6a6ba0ad1405d4c4f124863f4fc07a5dd0ee7df2c210c285eeb0c367d91d4e7e6e7c4865e6f494dbd3c211fb09ff4485621f69e819be3ebbb722fa
-
SSDEEP
12288:K2Co9kUzVAtb/WMdXDKDAObjsZt7P68BmPE:Kt39W8aTbjsH7P
Malware Config
Extracted
remcos
RemoteHost
93.95.115.2:9462
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-VI6D4O
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/996-37-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/996-42-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4544-32-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4544-45-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3508-35-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/996-37-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/4544-32-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/3508-31-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/996-42-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/4544-45-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Loads dropped DLL 1 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exepid process 224 HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exepid process 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exeHSBC PAYMENT CONFIRMATION COPY.PDF.exepid process 224 HSBC PAYMENT CONFIRMATION COPY.PDF.exe 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exeHSBC PAYMENT CONFIRMATION COPY.PDF.exedescription pid process target process PID 224 set thread context of 3516 224 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 set thread context of 4544 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 set thread context of 996 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 set thread context of 3508 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Drops file in Program Files directory 3 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exedescription ioc process File opened for modification C:\Program Files (x86)\bevirket\kabinettets.bef HSBC PAYMENT CONFIRMATION COPY.PDF.exe File opened for modification C:\Program Files (x86)\barbatimao.Gro HSBC PAYMENT CONFIRMATION COPY.PDF.exe File opened for modification C:\Program Files (x86)\Common Files\pernille\aftershine.ini HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exeHSBC PAYMENT CONFIRMATION COPY.PDF.exepid process 3508 HSBC PAYMENT CONFIRMATION COPY.PDF.exe 3508 HSBC PAYMENT CONFIRMATION COPY.PDF.exe 4544 HSBC PAYMENT CONFIRMATION COPY.PDF.exe 4544 HSBC PAYMENT CONFIRMATION COPY.PDF.exe 4544 HSBC PAYMENT CONFIRMATION COPY.PDF.exe 4544 HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exeHSBC PAYMENT CONFIRMATION COPY.PDF.exepid process 224 HSBC PAYMENT CONFIRMATION COPY.PDF.exe 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exedescription pid process Token: SeDebugPrivilege 3508 HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exepid process 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
HSBC PAYMENT CONFIRMATION COPY.PDF.exeHSBC PAYMENT CONFIRMATION COPY.PDF.exedescription pid process target process PID 224 wrote to memory of 3516 224 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 224 wrote to memory of 3516 224 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 224 wrote to memory of 3516 224 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 224 wrote to memory of 3516 224 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 224 wrote to memory of 3516 224 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 wrote to memory of 4544 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 wrote to memory of 4544 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 wrote to memory of 4544 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 wrote to memory of 996 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 wrote to memory of 996 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 wrote to memory of 996 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 wrote to memory of 3508 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 wrote to memory of 3508 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe PID 3516 wrote to memory of 3508 3516 HSBC PAYMENT CONFIRMATION COPY.PDF.exe HSBC PAYMENT CONFIRMATION COPY.PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe"C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe"C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe"C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe" /stext "C:\Users\Admin\AppData\Local\Temp\isgrvjb"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4544
-
-
C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe"C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe" /stext "C:\Users\Admin\AppData\Local\Temp\smmcvbmhmb"3⤵
- Accesses Microsoft Outlook accounts
PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe"C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cozuwuwbajcyy"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD589b56c55bfb3dde8af9e3eaedec2938d
SHA1cdb19a0ec9a711efb0c80aab1ceba1a6efc2057d
SHA25659e4cf3e20e6483fe845c7648fb91982cbd809d3c2f58c0847179ce9476166a4
SHA512a2f067697568e5f0b5592e535b8925fba6db549c59870a59d7cf5ab94181cbcb9c0714904003162dab128bdf7d620e4cd98de01e82dea157e627042715028dc3
-
Filesize
4KB
MD5135c60fadfa99b241d9109417db8b53c
SHA1b73785818a32e8d84bb55c02ccdc3d546a615526
SHA25601fc52f877352f6252d3d9351993fc35d7b6b0051ac6d3146184e12f9bc6e704
SHA51276812b91e51f1a206e3829b44cf13ee4cc4e5e90d88c0b0b3755b1e092eee26e6a4b18ef038a311a9443dab138761ff45fdd18145931207764c2355047611f51
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4