Malware Analysis Report

2025-01-02 03:10

Sample ID 240818-bskdmsxfkb
Target 8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe
SHA256 8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74
Tags
remcos remotehost collection credential_access discovery evasion execution rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74

Threat Level: Known bad

The file 8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe was found to be: Known bad.

Malicious Activity Summary

remcos remotehost collection credential_access discovery evasion execution rat stealer trojan

Remcos

Windows security bypass

UAC bypass

Detected Nirsoft tools

NirSoft MailPassView

Credentials from Password Stores: Credentials from Web Browsers

NirSoft WebBrowserPassView

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Command and Scripting Interpreter: PowerShell

Checks BIOS information in registry

Checks computer location settings

Windows security modification

Maps connected drives based on registry

Accesses Microsoft Outlook accounts

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System policy modification

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-18 01:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-18 01:24

Reported

2024-08-18 01:27

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe"

Signatures

Remcos

rat remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe = "0" C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe = "0" C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4016 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4016 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4016 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 1000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 3156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 3156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 3156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 5068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 5068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 5068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1388 wrote to memory of 5068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe

"C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /stext "C:\Users\Admin\AppData\Local\Temp\cxohfpxxobovwjg"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /stext "C:\Users\Admin\AppData\Local\Temp\erbzghqyckgizpukskw"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /stext "C:\Users\Admin\AppData\Local\Temp\ptgkhaasqsynjvqwbvjlfk"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /stext "C:\Users\Admin\AppData\Local\Temp\ptgkhaasqsynjvqwbvjlfk"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /stext "C:\Users\Admin\AppData\Local\Temp\ptgkhaasqsynjvqwbvjlfk"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /stext "C:\Users\Admin\AppData\Local\Temp\ptgkhaasqsynjvqwbvjlfk"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 192.210.150.26:8787 tcp
US 192.210.150.26:8787 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.150.210.192.in-addr.arpa udp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

memory/4016-1-0x00007FFD80083000-0x00007FFD80085000-memory.dmp

memory/4016-0-0x000001CCA5C60000-0x000001CCA5C6C000-memory.dmp

memory/4016-2-0x00007FFD80080000-0x00007FFD80B41000-memory.dmp

memory/4016-3-0x000001CCC0230000-0x000001CCC0300000-memory.dmp

memory/1388-4-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-5-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-6-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-7-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-11-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2068-12-0x00007FFD80080000-0x00007FFD80B41000-memory.dmp

memory/1388-10-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2068-13-0x00007FFD80080000-0x00007FFD80B41000-memory.dmp

memory/1388-24-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2068-25-0x000002515B900000-0x000002515B910000-memory.dmp

memory/2068-19-0x000002515B8D0000-0x000002515B8F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vuc5mge5.wvl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1388-27-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-26-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-31-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-28-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2068-32-0x00007FFD80080000-0x00007FFD80B41000-memory.dmp

memory/1388-34-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4016-38-0x00007FFD80080000-0x00007FFD80B41000-memory.dmp

memory/2132-41-0x0000000000400000-0x0000000000462000-memory.dmp

memory/5068-47-0x0000000000400000-0x0000000000424000-memory.dmp

memory/5068-46-0x0000000000400000-0x0000000000424000-memory.dmp

memory/5068-45-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2132-40-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1876-39-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2132-37-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1876-36-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1876-35-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cxohfpxxobovwjg

MD5 c7ac5a21cac5bd5580a6e28112212613
SHA1 0a256177c387053fec680e599bcb63729a16c161
SHA256 89e0e7dc8ad418f8613610b71d0c140247e26a5f9a453ee255b1467fb80f15ff
SHA512 753675a75b643132e50175d67589a3952cb5154a7e51c11883b2e28bf4fe406afbaed88e61575cc114156e41ed5c587b0f76845e6d20ddf922e775bfff3f0b43

memory/1388-50-0x0000000010000000-0x0000000010019000-memory.dmp

memory/1388-54-0x0000000010000000-0x0000000010019000-memory.dmp

memory/1388-53-0x0000000010000000-0x0000000010019000-memory.dmp

memory/1388-55-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-57-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-61-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-62-0x0000000000400000-0x0000000000482000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 ee3a21f1cd0b1fb31778bcca165d0a38
SHA1 9c6e58d437662ce569e5d470c8a353a0f26f29d3
SHA256 c48593887cd11ad83663f129421e904df222146a910f5fab94880de1d6dedec3
SHA512 92d49c1d13afecfeeddc668914168b93c55d1fca6e48dcb3a24f3a7d47283b34625654dfed12b3425bd07e09625f5747c5fcef21707b1bdbd2bbe84f8ca27a94

memory/1388-70-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-69-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-78-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-77-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-85-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-86-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-93-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1388-94-0x0000000000400000-0x0000000000482000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-18 01:24

Reported

2024-08-18 01:26

Platform

win7-20240729-en

Max time kernel

148s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe"

Signatures

Remcos

rat remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Program Files (x86)\Windows Mail\wab.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Windows Mail\wab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Windows Mail\wab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Windows Mail\wab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Windows Mail\wab.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Windows Mail\wab.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2356 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\System32\calc.exe
PID 2356 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2356 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2356 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2356 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2356 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\system32\WerFault.exe
PID 2356 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\system32\WerFault.exe
PID 2356 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe C:\Windows\system32\WerFault.exe
PID 2924 wrote to memory of 1724 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 1724 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 1724 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 1724 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 1724 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 1728 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 1728 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 1728 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 1728 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 1728 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 560 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 560 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 560 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 560 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe
PID 2924 wrote to memory of 560 N/A C:\Program Files (x86)\Windows Mail\wab.exe C:\Program Files (x86)\Windows Mail\wab.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe

"C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8fcca28a02a116ed9c02bfdcbe3bfb47206592110805aaeda4ad5c55aba82a74.exe" -Force

C:\Windows\System32\calc.exe

"C:\Windows\System32\calc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\Windows Mail\wab.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2356 -s 864

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kougsz"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uqarsszsg"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wknjtkjtustpn"

Network

Country Destination Domain Proto
US 192.210.150.26:8787 tcp
US 192.210.150.26:8787 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

memory/2356-0-0x000007FEF5843000-0x000007FEF5844000-memory.dmp

memory/2356-1-0x0000000001270000-0x000000000127C000-memory.dmp

memory/2356-2-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

memory/2356-3-0x0000000000C90000-0x0000000000D60000-memory.dmp

memory/2156-12-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2156-11-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2156-10-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2156-9-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2156-8-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2156-6-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2156-4-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2156-13-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2572-18-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

memory/2572-19-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

memory/2924-43-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-42-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-39-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-38-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-37-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2924-44-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-45-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-46-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-47-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-49-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1724-51-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1728-53-0x0000000000400000-0x0000000000462000-memory.dmp

memory/560-61-0x0000000000400000-0x0000000000424000-memory.dmp

memory/560-59-0x0000000000400000-0x0000000000424000-memory.dmp

memory/560-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1724-57-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1728-56-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1724-55-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1728-54-0x0000000000400000-0x0000000000462000-memory.dmp

memory/560-60-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kougsz

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2356-68-0x000007FEF5843000-0x000007FEF5844000-memory.dmp

memory/2924-69-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2924-72-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2924-73-0x0000000010000000-0x0000000010019000-memory.dmp

memory/2924-74-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2356-75-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

memory/2924-79-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-80-0x0000000000400000-0x0000000000482000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 f6bce702a3e668368cce55e39acee431
SHA1 b3c887737ef11c4151717d6ecbb77cab56a8756c
SHA256 c94807ac6f74893072b86b59178b66b0e6b7b504e2d9d3dd2b49036928784a7b
SHA512 2c4ed5c8c884f5a2e8ded36b8a7cc71c207bb8695ea01175692df631745528bb0a5b3b9b40da609b7877eb6834c30e419850ccb7dfbfeadbed6055d2422ec341

memory/2924-87-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-88-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-95-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-96-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2924-103-0x0000000000400000-0x0000000000482000-memory.dmp