Malware Analysis Report

2025-01-02 03:10

Sample ID 240817-en3k7swfmc
Target FTE98767800000.bat.exe
SHA256 8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74
Tags
remcos remotehost collection credential_access discovery evasion execution rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74

Threat Level: Known bad

The file FTE98767800000.bat.exe was found to be: Known bad.

Malicious Activity Summary

remcos remotehost collection credential_access discovery evasion execution rat stealer trojan

Windows security bypass

UAC bypass

Remcos

Detected Nirsoft tools

NirSoft WebBrowserPassView

Looks for VirtualBox Guest Additions in registry

Credentials from Password Stores: Credentials from Web Browsers

NirSoft MailPassView

Command and Scripting Interpreter: PowerShell

Looks for VMWare Tools registry key

Windows security modification

Checks computer location settings

Checks BIOS information in registry

Checks whether UAC is enabled

Maps connected drives based on registry

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Runs regedit.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-17 04:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-17 04:06

Reported

2024-08-17 04:08

Platform

win7-20240704-en

Max time kernel

148s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe"

Signatures

Remcos

rat remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Program Files (x86)\Windows Mail\wab.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Windows Mail\wab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Windows Mail\wab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Windows Mail\wab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Windows Mail\wab.exe N/A

Runs regedit.exe

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2384 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2384 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2384 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\regedit.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2384 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\system32\WerFault.exe
PID 2384 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\system32\WerFault.exe
PID 2384 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\system32\WerFault.exe
PID 3016 wrote to memory of 1828 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 1828 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 1828 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 1828 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 1828 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2908 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2908 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2908 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2908 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2908 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2920 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2920 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2920 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2920 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 3016 wrote to memory of 2920 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe

"C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe" -Force

C:\Windows\regedit.exe

"C:\Windows\regedit.exe"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\Windows Mail\wab.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2384 -s 824

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gvezwavqzkkpblbsamzughex"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jprswkfknsccdrpwjxmvjuyodjsb"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\trwcxdqljauhnxlatizpuzlwmqjcekq"

Network

Country Destination Domain Proto
US 192.210.150.26:8787 tcp
US 192.210.150.26:8787 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

memory/2384-0-0x000007FEF51F3000-0x000007FEF51F4000-memory.dmp

memory/2384-1-0x0000000001330000-0x000000000133C000-memory.dmp

memory/2384-2-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

memory/2384-3-0x0000000000AF0000-0x0000000000BC0000-memory.dmp

memory/2792-10-0x0000000002BA0000-0x0000000002C20000-memory.dmp

memory/2832-23-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2832-21-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2832-19-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2832-17-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2832-15-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2832-13-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2832-8-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2832-11-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2792-25-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

memory/2792-26-0x0000000002810000-0x0000000002818000-memory.dmp

memory/3016-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3016-44-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-50-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-49-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-47-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-45-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-51-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-52-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-53-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-54-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-56-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2908-60-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1828-64-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2920-68-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2920-67-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2920-66-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2908-63-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1828-62-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2908-61-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1828-58-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gvezwavqzkkpblbsamzughex

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2384-75-0x000007FEF51F3000-0x000007FEF51F4000-memory.dmp

memory/3016-77-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3016-76-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2384-78-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

memory/3016-83-0x0000000010000000-0x0000000010019000-memory.dmp

memory/3016-82-0x0000000010000000-0x0000000010019000-memory.dmp

memory/3016-79-0x0000000010000000-0x0000000010019000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 da7ca21d252bf5192430f5333c957003
SHA1 1da05775454c4797e4d2b56683a75f3c49059492
SHA256 68b37c1a528b774d736ad9f864b9b2b1d4f177ed93973393427e28401036fb1e
SHA512 d265a9448ded050f7c99aa70e4b3a99c805f82d59299911d21b9626a3ad5da7ed86a62fe4a4e7f4b1d264222b3a20435a2098f3b4049d272a88bb0acb9f66716

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-17 04:06

Reported

2024-08-17 04:08

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe"

Signatures

Remcos

rat remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe = "0" C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe = "0" C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2784 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 2816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 2816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 2816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 2816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 1500 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 1500 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 1500 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 1500 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 4144 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 4144 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 4144 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4864 wrote to memory of 4144 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe

"C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FTE98767800000.bat.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /stext "C:\Users\Admin\AppData\Local\Temp\oclvtahzolezzjvcx"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /stext "C:\Users\Admin\AppData\Local\Temp\ywqousasctwdcprggnvsp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /stext "C:\Users\Admin\AppData\Local\Temp\ayvynlluqcoqmwfkxyqlsorm"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 192.210.150.26:8787 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 192.210.150.26:8787 tcp
US 8.8.8.8:53 26.150.210.192.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 udp

Files

memory/2784-0-0x0000020CFA830000-0x0000020CFA83C000-memory.dmp

memory/2784-1-0x00007FF9FEBA3000-0x00007FF9FEBA5000-memory.dmp

memory/2784-2-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

memory/2784-3-0x0000020CFCE30000-0x0000020CFCF00000-memory.dmp

memory/4864-4-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-5-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-6-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-11-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-12-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-8-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4980-7-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

memory/4980-13-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

memory/4980-20-0x00000285F46B0000-0x00000285F46D2000-memory.dmp

memory/4980-24-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

memory/4864-25-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdqymatg.aeq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4980-28-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

memory/4864-29-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-30-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-31-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-32-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2784-33-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

memory/4864-35-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2816-37-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1500-38-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4144-41-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1500-44-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4144-43-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4144-42-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1500-40-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2816-39-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2816-45-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\oclvtahzolezzjvcx

MD5 a7e181f6aa185be0ab0ca68b30406fe6
SHA1 58c86162658dc609615b8b6400f85c92506dfdc8
SHA256 c3071dc55b94db225d9c0f2c1b21c7e8f27dbfd168b85b7d618d8d19950e7ff2
SHA512 49969eb10e0bf7925940eb7374451f811658ef9ccfb83b86fb337c4d06c3ba17eb0181f598d9e0ec9ca25bfaf644209ac47b73d62ac924e73d03a4dcf8f8dd0f

memory/4864-51-0x0000000010000000-0x0000000010019000-memory.dmp

memory/4864-54-0x0000000010000000-0x0000000010019000-memory.dmp

memory/4864-55-0x0000000010000000-0x0000000010019000-memory.dmp

memory/4864-56-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-57-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-58-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-60-0x0000000000400000-0x0000000000482000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 bb0adab5629c444c7b72b8a6af556be7
SHA1 080c68a9c92485e1983f1999667355ba56a0905c
SHA256 d750675613f95484290a35cc019b9d959a981b512ad1fb7d182a7f4462190700
SHA512 92edfacda360e79f1b7117c7502ce34dbf44ae5e059851fb0b2f1989c2c85276f9264f3c395ffc89d6a4f9637cc286a9bc9e732633a7aa739f6ed495c1318aef

memory/4864-66-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-67-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-74-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-75-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-83-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-82-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-90-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4864-91-0x0000000000400000-0x0000000000482000-memory.dmp