Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe
Resource
win10v2004-20240709-en
General
-
Target
589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe
-
Size
1.7MB
-
MD5
658e8867a46096faafb9939ba1faeb1a
-
SHA1
bfe077b029a1a6d4beeda154fa706f4ff0cfff82
-
SHA256
589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a
-
SHA512
ead89fa50f5c499e04fccf187257ca634d6168de6a662fa139282e871447a361ca33fd94a96b152a9324af2bc532c9fa2045af945dd0a86a11909aeac770689b
-
SSDEEP
24576:WR3njD6TaOQ5KJh7WXePuq5LktSbm5ktGn:qjD65Q5Kz7WXJq5Lkt6m/n
Malware Config
Extracted
remcos
Dollar Man
178.23.190.118:52499
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-SJ9MVF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Detected Nirsoft tools 4 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/1628-99-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/556-100-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/1628-107-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/556-110-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/556-100-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/556-110-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/1628-99-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/1628-107-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wmplayer.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2968 set thread context of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2880 set thread context of 1628 2880 wmplayer.exe 37 PID 2880 set thread context of 556 2880 wmplayer.exe 38 PID 2880 set thread context of 1544 2880 wmplayer.exe 39 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1628 wmplayer.exe 1628 wmplayer.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2880 wmplayer.exe 2880 wmplayer.exe 2880 wmplayer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe Token: SeDebugPrivilege 1544 wmplayer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2880 wmplayer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2536 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 31 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2312 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 32 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2712 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 33 PID 2968 wrote to memory of 2796 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 34 PID 2968 wrote to memory of 2796 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 34 PID 2968 wrote to memory of 2796 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 34 PID 2968 wrote to memory of 2796 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 34 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2880 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 35 PID 2968 wrote to memory of 2600 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 36 PID 2968 wrote to memory of 2600 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 36 PID 2968 wrote to memory of 2600 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 36 PID 2968 wrote to memory of 2600 2968 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 36 PID 2880 wrote to memory of 1628 2880 wmplayer.exe 37 PID 2880 wrote to memory of 1628 2880 wmplayer.exe 37 PID 2880 wrote to memory of 1628 2880 wmplayer.exe 37 PID 2880 wrote to memory of 1628 2880 wmplayer.exe 37 PID 2880 wrote to memory of 1628 2880 wmplayer.exe 37 PID 2880 wrote to memory of 556 2880 wmplayer.exe 38 PID 2880 wrote to memory of 556 2880 wmplayer.exe 38 PID 2880 wrote to memory of 556 2880 wmplayer.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe"C:\Users\Admin\AppData\Local\Temp\589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"2⤵PID:2536
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵PID:2312
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵PID:2712
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:2796
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nbaxtuupiysgloaspe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1628
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xvgqumfjwgklvcwwgpkou"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:556
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zptivfqlspcyxikapafqfosd"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5a81c9318bc6e74457434009e6cd29591
SHA121ad528e56c8a3e304b54c0b79cbc85824eeed62
SHA256d2d782040d30d7e0f29b66f2f056079016b250612579ee603d147ab2b933e378
SHA512cd90bcb161069c1301e3330fb6270970c36d5f6fdbff531c4b8d988d63bfc3a8b2405d49c8e7bd6cc69118fa7798df05a788b82d4bb77aee4a47c3005bd600f4
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84