Analysis
-
max time kernel
146s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 08:45
Static task
static1
Behavioral task
behavioral1
Sample
E_Remit-(John)CQDM.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
E_Remit-(John)CQDM.html
Resource
win10v2004-20241007-en
General
-
Target
E_Remit-(John)CQDM.html
-
Size
7KB
-
MD5
1eaf3e9e722ae8fbd24fbf217a34e98e
-
SHA1
4d1b349d7a60e6aa63cb2baec99425aeea937cf2
-
SHA256
76c120797a6ee136d57c06f832bdc9c57b1660ffd12b74187a564cb7695fcc60
-
SHA512
d6cc59205b0c2f4d7cd5eb4b22418e31270ef4f55c138c36fcc1c0619406b615b37dc16f0de50ad081c56b282cd08dbb9c8cf38c5b9fb85658db079586cb7efe
-
SSDEEP
192:5q8eu3R5WcZQ6QEC4RQPl+DirMkbW0VEJxOuD:5qYR5Wv6Q94RGl+t0VWV
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 216 msedge.exe 216 msedge.exe 2268 msedge.exe 2268 msedge.exe 1596 identity_helper.exe 1596 identity_helper.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 1036 2268 msedge.exe 83 PID 2268 wrote to memory of 1036 2268 msedge.exe 83 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 3548 2268 msedge.exe 85 PID 2268 wrote to memory of 216 2268 msedge.exe 86 PID 2268 wrote to memory of 216 2268 msedge.exe 86 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87 PID 2268 wrote to memory of 2832 2268 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\E_Remit-(John)CQDM.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb315846f8,0x7ffb31584708,0x7ffb315847182⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:82⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17208386183818193348,13171344658518342048,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2796
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD599afa4934d1e3c56bbce114b356e8a99
SHA13f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA25608e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA51276686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
-
Filesize
152B
MD5443a627d539ca4eab732bad0cbe7332b
SHA186b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA2561e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
-
Filesize
333B
MD5327da654c29f77ad5d4b97c5d6bc2caa
SHA1afdc634403355f9bdd7ab5596c281de14be22151
SHA2562716e829c335db312e289e67a7b5e8b40b4847f67a2a6434314e94c9b085cd9c
SHA512bcd11261d027730ad0dbc4c036a12335266ae621e7d5e77abc2561ba18e1c987553bd2d8fc7fe9a191fdded80d9927493275b4cad2c8637d1d73e94a3f5fb66d
-
Filesize
6KB
MD5b29ff40cc0f2c885a1884b1001cd684e
SHA1b553ee9ae5a29086b60aeec00d8cd4d2c3d5b7c6
SHA256133f877bac2c3edc00d253e790725d6d15e4ee3a51d153601ac33ea936488367
SHA5121c43fb2524da71ac8fd3151fae1d1c8f809393b0fda57098fc698f0e67f48f86282309f40d1f6b22301932c97ddeacb3c8c67192a38e40f2ab2a4849b8b1414d
-
Filesize
6KB
MD5259942793b3d9ad6e599e79782083ffd
SHA1b355112b967726aa281499562d2d8f51b18212ec
SHA256d7792d0433f963fa15cec384cf5f7c1a1ff3f0fa3e65094a3f6d7da89c0c822a
SHA51258200505a8fed02024b044be8ed4f3adaffc63cb0a243e988e84fa25b5bc92b8ff2578d1cf4001a50287875cf0fee308c0b19ecb6b9f7b21028997c02f15d0fa
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD5ae84b9aa5f0918fd9794baeddf21b47b
SHA123ffbd7db7e1f30b190379a9bf0224df853bb234
SHA2560cc9cb336c12a189a1aac43176e765e625865011e05220e42ac258dca3a37d84
SHA512b15d86575af8cd97b4dfc83349821b6341d82d4efedab0b4849ced088870b9fc6baabb8d0eab984af1fcd34ff84ec2351e647904eefe2d279da9a540c9e06bc8