hxxp://mobile[.]remote[.]move123[.]be

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mobile.remote.move123.be

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
3548	msedge.exe
3548	msedge.exe
1412	identity_helper.exe
1412	identity_helper.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 4400	3548	msedge.exe	83
PID 3548 wrote to memory of 4400	3548	msedge.exe	83
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 3208	3548	msedge.exe	85
PID 3548 wrote to memory of 4600	3548	msedge.exe	86
PID 3548 wrote to memory of 4600	3548	msedge.exe	86
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87
PID 3548 wrote to memory of 5048	3548	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mobile.remote.move123.be
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4b2446f8,0x7ffa4b244708,0x7ffa4b244718
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1969593201172753449,15995934697258614221,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99743c66-3df4-4802-9f36-93ad57f25ecf.tmp

Filesize
6KB

MD5
03417fbe9b2a252dff67025f63a906c3

SHA1
1fabb6b2be98cea23eec60c3a4916e38e1a16e5e

SHA256
97cced6601db363bdd9fe074ae2029ff8a4dc3d99d598d9bf0b9db0aecfb5831

SHA512
7fdb760c78c317fe73b8cdab663333f852557ed86d16ebaee4aeafbcf75e2cf35482f37ca90678878ab8367e2eb1655a8bcb7e4624a5f60361ea09272b3581b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b748d9a34ded5cef569204a751297608

SHA1
9c7598fa365712450ac7c28a192e040bde99f9ee

SHA256
83058964b06727d19946bd61a6a9ba4eb27bfc35ca1a70fc8f78dee81e2f88db

SHA512
39fff5b59f2e43ca5accc08caa6141ac23902f3ddc40e150de0d9739396ac93eb2088d202c13fca0e8aad1303177ced2d2fd8083c2d27b2645a19012590050f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c3acf1d9ea8bd1afd586b287e64c53ac

SHA1
9547a3a6f6a522c6112679d6ff3adaf6b794ffd0

SHA256
ca8d694b147201d250147b5a8cd010098a9951cbb0b26e15041d5f939dba58dc

SHA512
b779dc3484ead245b60078b9f5de4a81854f232d071051ac56d54d08021bcf6ed00f1c9d01b1c77145f0c931e0f68ec412196924f4346e9ba8eff065be592ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
95262ac0c9ace5662bc8b1343f93a1d6

SHA1
947f33137ea2e24aba61049e18ce644d7b74ca9d

SHA256
044d5f0543909e4425d0e89bd890ccc89315f38a4b1c3e4fbb35b1c14c081f70

SHA512
df0ac38867f8fad540897c4c55093b2e6506f6a2cd9975aacceedb827f2c75605b2d90bbcce953c7231798a691734b039fc02e1c1f39624652ecf2c952f95c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
007b907528baa23532f96db19f7cd64c

SHA1
730e7e8f6f9fb97756bcac15ed6fa0a2dd882b84

SHA256
ee071e19a7fc23f4317f0cbe75acc03843268e856a07ae3ea2ca378631831fb5

SHA512
6e550c6c3d7157b5ae03ae976724d0618adf8493f7cefc4802ac7dd7d32a0753f9446597f850a93229b2bb8d965687f1513408fd7312d4eeabad5761a75bf6b6

Download Submit