Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe
Resource
win10v2004-20240709-en
General
-
Target
589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe
-
Size
1.7MB
-
MD5
658e8867a46096faafb9939ba1faeb1a
-
SHA1
bfe077b029a1a6d4beeda154fa706f4ff0cfff82
-
SHA256
589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a
-
SHA512
ead89fa50f5c499e04fccf187257ca634d6168de6a662fa139282e871447a361ca33fd94a96b152a9324af2bc532c9fa2045af945dd0a86a11909aeac770689b
-
SSDEEP
24576:WR3njD6TaOQ5KJh7WXePuq5LktSbm5ktGn:qjD65Q5Kz7WXJq5Lkt6m/n
Malware Config
Extracted
remcos
Dollar Man
178.23.190.118:52499
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-SJ9MVF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Detected Nirsoft tools 6 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/2256-34-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/1832-33-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/1832-38-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/1832-31-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/752-30-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2256-40-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/1832-33-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/1832-38-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/1832-31-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2256-34-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/2256-40-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wmplayer.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 392 set thread context of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 4580 set thread context of 2256 4580 wmplayer.exe 97 PID 4580 set thread context of 1832 4580 wmplayer.exe 98 PID 4580 set thread context of 752 4580 wmplayer.exe 100 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2256 wmplayer.exe 2256 wmplayer.exe 752 wmplayer.exe 752 wmplayer.exe 2256 wmplayer.exe 2256 wmplayer.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 4580 wmplayer.exe 4580 wmplayer.exe 4580 wmplayer.exe 4580 wmplayer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe Token: SeDebugPrivilege 752 wmplayer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4580 wmplayer.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 4580 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 88 PID 392 wrote to memory of 2628 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 89 PID 392 wrote to memory of 2628 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 89 PID 392 wrote to memory of 2628 392 589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe 89 PID 4580 wrote to memory of 2256 4580 wmplayer.exe 97 PID 4580 wrote to memory of 2256 4580 wmplayer.exe 97 PID 4580 wrote to memory of 2256 4580 wmplayer.exe 97 PID 4580 wrote to memory of 2256 4580 wmplayer.exe 97 PID 4580 wrote to memory of 1832 4580 wmplayer.exe 98 PID 4580 wrote to memory of 1832 4580 wmplayer.exe 98 PID 4580 wrote to memory of 1832 4580 wmplayer.exe 98 PID 4580 wrote to memory of 1832 4580 wmplayer.exe 98 PID 4580 wrote to memory of 4752 4580 wmplayer.exe 99 PID 4580 wrote to memory of 4752 4580 wmplayer.exe 99 PID 4580 wrote to memory of 4752 4580 wmplayer.exe 99 PID 4580 wrote to memory of 752 4580 wmplayer.exe 100 PID 4580 wrote to memory of 752 4580 wmplayer.exe 100 PID 4580 wrote to memory of 752 4580 wmplayer.exe 100 PID 4580 wrote to memory of 752 4580 wmplayer.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe"C:\Users\Admin\AppData\Local\Temp\589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\abclophiy"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2256
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kdpepiakuvqv"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:1832
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vyuwqaleidiaofjl"3⤵PID:4752
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vyuwqaleidiaofjl"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD54a9475f37cc21f726656822c99f348c6
SHA10356ce7c38dd238f2cc5c9fa85519487ee9fc45b
SHA256971cce63daedc52546dc59e906125f3016f7c5dd6f4fedc3930d3f215a3ff85b
SHA512e5b82cc35f34c00650efda68bb544f592e52666a7bc81dd8ace512ce8a611c2fc1f7cadea3f88a9360cc0da8e8372244f52ecd70b11d676f08bd6c126fdfc06a
-
Filesize
4KB
MD571e3611290752b1a114e303d84e3987f
SHA1210794023f369235615743c802fce5055961ee6e
SHA2565163d0e849d5d39f1e8beb9d13beea8240d532dff6f28433522148628007af06
SHA512d0235dd58f9038009e44c4847535f2bb652f093418fdfd890c01b4b9d8981df3a31e4a89f9099c226becbfe8541015d60f6b852165241d08cb8795d93dd2eb09