Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
23/08/2024, 08:43
General
-
Target
SecuriteInfo.com.Trojan.DownLoader47.28778.10975.2985.exe
-
Size
3.5MB
-
MD5
2e5655f2cfebe6357e6388e678f3c073
-
SHA1
f1d6b68d73a8da906368837c1cde74a26a900858
-
SHA256
3c74031a1ddcfbff9691d2992ecd540eb82c4b781bda9ffc5125d40ec712589d
-
SHA512
13477f0bc9a73809e7b069dc441c7fb0023178811f4fe3f39ccbc4b4c412516b612439d8025b0c79c33201c791b343cdcf7dec4a3fe7eabcd3e28b1cf520747f
-
SSDEEP
98304:cUROmKjJqajychmAfNKcA+hv5r61JD4XEdGic/7FW:TsqzcEAfhrr0D4UdGb/hW
Malware Config
Extracted
remcos
RemoteHost
192.3.101.172:9674
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Log
-
keylog_path
%Temp%
-
mouse_option
false
-
mutex
Rmc-54ZTI0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader47.28778.10975.2985.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader47.28778.10975.2985.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader47.28778.10975.2985.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader47.28778.10975.2985.exe /stext "C:\Users\Admin\AppData\Local\Temp\bbinruvidpxv"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader47.28778.10975.2985.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader47.28778.10975.2985.exe /stext "C:\Users\Admin\AppData\Local\Temp\ewvyrmgcrxpaujo"2⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader47.28778.10975.2985.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader47.28778.10975.2985.exe /stext "C:\Users\Admin\AppData\Local\Temp\oyaqsfqdffhmepktev"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD590c605805386e8f8995c57c81b1c8678
SHA1f24fb12e2c0b0b960755130f674eefe239516e0c
SHA256166689dcbfe339ea570561bf7871323b21795936dac1d3aab43ad982dad2db3c
SHA51278026577ec7070afbc195ea7e7f2d020f9e5b4c5a4fefeb82fec66579adb01ecb1c3bb5f5ed93c0442e5c7102d2fe003e5f7addb9c34bcfa54249dbd96874b9a
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
8KB
MD5e1db733e43aa8d065fb7e8669db76524
SHA13f9c62ee28959959271632fdc7f5387d539a1d23
SHA2569e65d9e8ebb895f3b03c95ce64f044c70251fff444a4bcbee83f558b599a614d
SHA5123f6106f32932e72d197865f7b796eba072c8ab20c22b4d205f27de9b9fc6c139be8450ae25541fbdac37a06bc3ec2d1fab3f9b3216201a9231b70fcde6fb8eb3
-
Filesize
9.4MB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
508KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
508KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
9.4MB
-
Filesize
508KB
-
Filesize
9.4MB
-
Filesize
508KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
9.4MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
480KB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
9.4MB
-
Filesize
9.4MB