Analysis
-
max time kernel
413s -
max time network
389s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2024 15:00
Static task
static1
Behavioral task
behavioral1
Sample
1_setup-rem_ovl.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
1_setup-rem_ovl.exe
Resource
win11-20240730-en
windows11-21h2-x64
General
-
Target
1_setup-rem_ovl.exe
-
Size
4.4MB
-
MD5
58563fab8999891e35869b2cf6fdd67d
-
SHA1
172706bd7e83f8e832af5214295c9931a4981abb
-
SHA256
3a1d2daef3617f82a5d3f5a91f4f78d9ff5e2a2125f9f524d3d0bcd0bf3d43ed
-
SHA512
705bf4179bc13793fdea11365f2b8f64d97db9e66536355e0e8927e6b27d1956b7fb98d87cbf890cff5e55bdf36a514eea9c90bff0567104d9195c4a527deaaa
-
SSDEEP
98304:5Enod59JLovWfw6JzPocNK52w8dudhWhAKiVGRM:RDT948zA12w8du3oOVG
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 1 IoCs
Processes:
1_setup-rem_ovl.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" 1_setup-rem_ovl.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1_setup-rem_ovl.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation 1_setup-rem_ovl.exe -
Executes dropped EXE 1 IoCs
Processes:
G_Yg8BzdWJHyD9S0VAllkgvW.exepid Process 3768 G_Yg8BzdWJHyD9S0VAllkgvW.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 api.myip.com 8 api.myip.com 11 ipinfo.io 12 ipinfo.io -
Drops file in System32 directory 4 IoCs
Processes:
1_setup-rem_ovl.exedescription ioc Process File opened for modification C:\Windows\System32\GroupPolicy 1_setup-rem_ovl.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini 1_setup-rem_ovl.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 1_setup-rem_ovl.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 1_setup-rem_ovl.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1460 3768 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
G_Yg8BzdWJHyD9S0VAllkgvW.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language G_Yg8BzdWJHyD9S0VAllkgvW.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1_setup-rem_ovl.exeG_Yg8BzdWJHyD9S0VAllkgvW.exetaskmgr.exepid Process 1812 1_setup-rem_ovl.exe 1812 1_setup-rem_ovl.exe 3768 G_Yg8BzdWJHyD9S0VAllkgvW.exe 3768 G_Yg8BzdWJHyD9S0VAllkgvW.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 1736 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid Process Token: SeDebugPrivilege 1736 taskmgr.exe Token: SeSystemProfilePrivilege 1736 taskmgr.exe Token: SeCreateGlobalPrivilege 1736 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe 1736 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1_setup-rem_ovl.exedescription pid Process procid_target PID 1812 wrote to memory of 3768 1812 1_setup-rem_ovl.exe 90 PID 1812 wrote to memory of 3768 1812 1_setup-rem_ovl.exe 90 PID 1812 wrote to memory of 3768 1812 1_setup-rem_ovl.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\1_setup-rem_ovl.exe"C:\Users\Admin\AppData\Local\Temp\1_setup-rem_ovl.exe"1⤵
- Modifies firewall policy service
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\Documents\piratemamm\G_Yg8BzdWJHyD9S0VAllkgvW.exeC:\Users\Admin\Documents\piratemamm\G_Yg8BzdWJHyD9S0VAllkgvW.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 5243⤵
- Program crash
PID:1460
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:1996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:5068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3768 -ip 37681⤵PID:4304
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1736
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD58d42ba325d439d34aab2f72042b05993
SHA1ddeefc17ab621ca3bab177a2c56cbdc0d2c36aa4
SHA256430665ab2cf47e460029aa0fe5317f1d97cbdb4e5e9c31525f1b9c7631fb3eb2
SHA512991ec475bf14440a50e5a7ed7f37b383b9c0beff257fab882b14bcd1055e89f7f27b645665bd96c34c48ebb7cbd6472782176584ad972d7f2cfca42a8730f585
-
Filesize
1.4MB
MD5d7780c3c6c337a3c9b223c25cc88c3f3
SHA1c0859c0452200ce44c31c9de2cd99e3503882617
SHA2569a73f40cc2c3e4fbcb7de098ba947484b7ee15919c3933d252369e4c11ab638e
SHA512461f4bd982f59105be54d5ddf1cc696fa1914f288232221e163ad2778517a7a1fa89cff2622100ee99d9835d9a1fd297003ab8f7c7cf74fd887be411742fcb62
-
Filesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005