Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06-11-2024 12:37
Static task
static1
Behavioral task
behavioral1
Sample
RFQ 6000208225.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
RFQ 6000208225.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
RFQ 6000208225.exe
-
Size
1.3MB
-
MD5
3392cd428f177152dcf9ac6256365b1a
-
SHA1
3e454db1c2d909510594a48efbe0380c3194aa2f
-
SHA256
1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1
-
SHA512
53265bead60447f7dd26db363dfe3a698d83c51019c4fa1d51907d5166cd53e11dae4da51ee3ebe162f0313ac6b2971a0a3904a4738fde116d835eab4c4d53bb
-
SSDEEP
24576:Z6k1f9gIpCzUjadgzQdbzyoxSyz74WCePDMoqno2NND74lams:ZJFmSCzyApoy/p3PDP6Ela3
Malware Config
Extracted
remcos
RemoteHost
212.162.149.220:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2JYO24
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Remcos family
-
Detected Nirsoft tools 8 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
Processes:
resource yara_rule behavioral1/memory/2684-44-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2724-45-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/2724-43-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/2684-42-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1388-49-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1388-50-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/2684-56-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2724-62-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2724-45-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/2724-43-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/2724-62-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/2684-44-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/2684-42-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/2684-56-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Loads dropped DLL 2 IoCs
Processes:
RFQ 6000208225.exepid process 2300 RFQ 6000208225.exe 2300 RFQ 6000208225.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
RFQ 6000208225.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts RFQ 6000208225.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
RFQ 6000208225.exepid process 2964 RFQ 6000208225.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
RFQ 6000208225.exeRFQ 6000208225.exepid process 2300 RFQ 6000208225.exe 2964 RFQ 6000208225.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQ 6000208225.exeRFQ 6000208225.exedescription pid process target process PID 2300 set thread context of 2964 2300 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 set thread context of 2684 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 set thread context of 2724 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 set thread context of 1388 2964 RFQ 6000208225.exe RFQ 6000208225.exe -
Drops file in Windows directory 1 IoCs
Processes:
RFQ 6000208225.exedescription ioc process File opened for modification C:\Windows\karga.ini RFQ 6000208225.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RFQ 6000208225.exeRFQ 6000208225.exeRFQ 6000208225.exeRFQ 6000208225.exeRFQ 6000208225.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ 6000208225.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ 6000208225.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ 6000208225.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ 6000208225.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ 6000208225.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RFQ 6000208225.exepid process 2684 RFQ 6000208225.exe 2684 RFQ 6000208225.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
RFQ 6000208225.exeRFQ 6000208225.exepid process 2300 RFQ 6000208225.exe 2964 RFQ 6000208225.exe 2964 RFQ 6000208225.exe 2964 RFQ 6000208225.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RFQ 6000208225.exedescription pid process Token: SeDebugPrivilege 1388 RFQ 6000208225.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RFQ 6000208225.exepid process 2964 RFQ 6000208225.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
RFQ 6000208225.exeRFQ 6000208225.exedescription pid process target process PID 2300 wrote to memory of 2964 2300 RFQ 6000208225.exe RFQ 6000208225.exe PID 2300 wrote to memory of 2964 2300 RFQ 6000208225.exe RFQ 6000208225.exe PID 2300 wrote to memory of 2964 2300 RFQ 6000208225.exe RFQ 6000208225.exe PID 2300 wrote to memory of 2964 2300 RFQ 6000208225.exe RFQ 6000208225.exe PID 2300 wrote to memory of 2964 2300 RFQ 6000208225.exe RFQ 6000208225.exe PID 2300 wrote to memory of 2964 2300 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 2684 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 2684 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 2684 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 2684 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 2724 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 2724 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 2724 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 2724 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 1388 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 1388 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 1388 2964 RFQ 6000208225.exe RFQ 6000208225.exe PID 2964 wrote to memory of 1388 2964 RFQ 6000208225.exe RFQ 6000208225.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wffvlpgpdzepqduzlcoegwnvn"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hitolirqrhwuajidumigjbieoewtv"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 6000208225.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jcyymackfpogcxehdxvzuocvxkfcopxp"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD58ac1dbd9638470a6f6a205869a00ba68
SHA15984d595bdefa760c4c91b3da686ef0db804e605
SHA256df6248a62c64e054315f0b55bbf8db4f59cd714a43bde7f3bb998e53091da079
SHA51220fdc612785052a7f30d14c9ef4567266ee9bb73ea77ac40857b4ff6507ca0fe55eb7ea53c9b417f7f59e2283804a8b76be41d89dd5c4da085265aa2c4e1766f
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
11KB
MD5fc3772787eb239ef4d0399680dcc4343
SHA1db2fa99ec967178cd8057a14a428a8439a961a73
SHA2569b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
SHA51279e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89