Analysis
-
max time kernel
147s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:10
Static task
static1
Behavioral task
behavioral1
Sample
524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr
Resource
win10v2004-20240508-en
General
-
Target
524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr
-
Size
1.3MB
-
MD5
60561cff1dee1f6bab79d28ab8a84dc3
-
SHA1
abd6f2841675755c088b4d70dee090225caa73db
-
SHA256
b27ccf7bb556e1f332c8feb3a12f6f3c4b0ba949c059cdc3a1bdd416fb87921e
-
SHA512
ab073292660e415fbc8181fe7fefb83c3cdb92531fd4812742f7143dc31a75f1ab8b0e72279d02ffef137956502aa5c13a8e78ed1894ffd648de74b11c946fff
-
SSDEEP
24576:4Mbni723L73/gXFxoYXpmTvCkV0uf5ZmH1OvAwP0Cwbn:43a3L73ou7vCkCua1RwML
Malware Config
Extracted
remcos
RemoteHost
104.250.180.178:7902
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Microsoft .exe
-
copy_folder
Microsoft
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Microsoft -QUCX7D
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2768-48-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/2768-47-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/2768-55-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/628-45-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/628-44-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/628-53-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2768-48-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/2768-47-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/2752-46-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/628-45-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/628-44-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/628-53-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2768-55-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts AddInProcess32.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scrAddInProcess32.exedescription pid process target process PID 2844 set thread context of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 3024 set thread context of 628 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 set thread context of 2768 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 set thread context of 2752 3024 AddInProcess32.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scrAddInProcess32.exepid process 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr 628 AddInProcess32.exe 628 AddInProcess32.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
AddInProcess32.exepid process 3024 AddInProcess32.exe 3024 AddInProcess32.exe 3024 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scrAddInProcess32.exedescription pid process Token: SeDebugPrivilege 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr Token: SeDebugPrivilege 2752 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scrAddInProcess32.exedescription pid process target process PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 2844 wrote to memory of 3024 2844 524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr AddInProcess32.exe PID 3024 wrote to memory of 628 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 628 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 628 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 628 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 628 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2768 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2768 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2768 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2768 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2768 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2752 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2752 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2752 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2752 3024 AddInProcess32.exe AddInProcess32.exe PID 3024 wrote to memory of 2752 3024 AddInProcess32.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr"C:\Users\Admin\AppData\Local\Temp\524 KAO – SH 1X40HQ (代用) BOOKING資料如下~ EXWORK 1X40HQ.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\ctxjjdcbmapxxqgqnbnuigvuejfrwxkek"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\evcuc"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\pppmcggw"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ctxjjdcbmapxxqgqnbnuigvuejfrwxkekFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/628-39-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/628-33-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/628-45-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/628-44-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/628-53-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2752-43-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2752-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2752-46-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2752-42-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2768-48-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/2768-55-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/2768-47-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/2768-36-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/2768-40-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/2844-0-0x000000007411E000-0x000000007411F000-memory.dmpFilesize
4KB
-
memory/2844-8-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/2844-7-0x0000000000580000-0x0000000000586000-memory.dmpFilesize
24KB
-
memory/2844-19-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/2844-6-0x00000000006A0000-0x00000000006BA000-memory.dmpFilesize
104KB
-
memory/2844-5-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/2844-4-0x000000007411E000-0x000000007411F000-memory.dmpFilesize
4KB
-
memory/2844-23-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/2844-3-0x0000000004850000-0x0000000004894000-memory.dmpFilesize
272KB
-
memory/2844-2-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/2844-1-0x00000000012A0000-0x00000000013FC000-memory.dmpFilesize
1.4MB
-
memory/3024-12-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-28-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-30-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-27-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-26-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-25-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-22-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-24-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-21-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-20-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3024-17-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-16-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-15-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-14-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-11-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-10-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-9-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-56-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/3024-59-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/3024-60-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/3024-61-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-62-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-63-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3024-64-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB