Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2024 01:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp6yepb2lk.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
tmp6yepb2lk.exe
Resource
win10v2004-20240802-en
General
-
Target
tmp6yepb2lk.exe
-
Size
77KB
-
MD5
850bb666d97b841c0df079f321a440f7
-
SHA1
3618d43d64d281a2aa2d551abd5bb805e6352a51
-
SHA256
b30ebf707e45596c98eef8d06bdb344c616a1f8e1722b3c1ec3f8ad7635d91f4
-
SHA512
7900edec0ccf7e7a4a459f98bb31b07815b2586bc5e461f30474b4aca25b3e40e188ccbd465fed76682111fb6651b5631ddf3e857324f0f1b8d05e37575f8407
-
SSDEEP
768:mKGhS24vnz5SU2Ip4jBqltCF0AxEjenoB69+FxC:u824vnlSFHBWAxEjc+a
Malware Config
Extracted
remcos
59b3ch7k27
91.92.240.98:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-N5F1RT
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 216 created 3520 216 tmp6yepb2lk.exe 56 -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Detected Nirsoft tools 5 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/1784-1118-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/1608-1119-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/1608-1125-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2280-1126-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/1784-1128-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/2280-1126-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/1784-1118-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/1784-1128-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xkicthde = "C:\\Users\\Admin\\AppData\\Roaming\\Xkicthde.exe" tmp6yepb2lk.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 216 set thread context of 3468 216 tmp6yepb2lk.exe 97 PID 3468 set thread context of 1784 3468 InstallUtil.exe 102 PID 3468 set thread context of 2280 3468 InstallUtil.exe 103 PID 3468 set thread context of 1608 3468 InstallUtil.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp6yepb2lk.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 216 tmp6yepb2lk.exe 1608 InstallUtil.exe 1784 InstallUtil.exe 1608 InstallUtil.exe 1784 InstallUtil.exe 1784 InstallUtil.exe 1784 InstallUtil.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 3468 InstallUtil.exe 3468 InstallUtil.exe 3468 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 216 tmp6yepb2lk.exe Token: SeDebugPrivilege 216 tmp6yepb2lk.exe Token: SeDebugPrivilege 1608 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 216 wrote to memory of 3468 216 tmp6yepb2lk.exe 97 PID 3468 wrote to memory of 1784 3468 InstallUtil.exe 102 PID 3468 wrote to memory of 1784 3468 InstallUtil.exe 102 PID 3468 wrote to memory of 1784 3468 InstallUtil.exe 102 PID 3468 wrote to memory of 1784 3468 InstallUtil.exe 102 PID 3468 wrote to memory of 2280 3468 InstallUtil.exe 103 PID 3468 wrote to memory of 2280 3468 InstallUtil.exe 103 PID 3468 wrote to memory of 2280 3468 InstallUtil.exe 103 PID 3468 wrote to memory of 2280 3468 InstallUtil.exe 103 PID 3468 wrote to memory of 1608 3468 InstallUtil.exe 104 PID 3468 wrote to memory of 1608 3468 InstallUtil.exe 104 PID 3468 wrote to memory of 1608 3468 InstallUtil.exe 104 PID 3468 wrote to memory of 1608 3468 InstallUtil.exe 104
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\tmp6yepb2lk.exe"C:\Users\Admin\AppData\Local\Temp\tmp6yepb2lk.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\hsjnjtkjadakgohwecohtjaocstlf"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1784
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\kmogjlvdomsojuvannbiwovxlzkugkqc"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:2280
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\uoty"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD515e28d82a9ee8a45c10bcf671fef0362
SHA12b126b086a1191cb8b4d444e87781358d51af3a4
SHA256012fbb5f15d52a9560cf0e77fd36837ec2c56aff7a989d31c3d40d4f6df6cf9d
SHA5123dd749523858a54e7e5ededba47d54715c9d5663dd0bd609363de7442436d1f0e924c5e4706e3ac413b79ddb6a18c796cc0ad166b4c87a3a7a6b009ba77fee82