amadey | 78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
Size

3.2MB
MD5

7446e32ee2697758d8a5ed74e79bac34
SHA1

1e4beba935149218af721846c82fd17ca0a6ea7d
SHA256

78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa
SHA512

e5f812d4fd08c46a838147bc6d50499080c1a992a59c8b135fae2974d01cabef509c0fe007af7e7839364cc541379b7df2936dcb8b1009732b71be73b73e87f7
SSDEEP

49152:Wx8HpjVwvX+RiiKOb6d0GCns5yCn2Ft0C4CkDiawVzAD2gmv:S8HDk+RiiKOb6dZCns7uH4AVcDtm

Score

10^/10

amadey lumma remcos stealc 9c9aa5 dpdnow tale collection discovery evasion persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

remcos

Botnet

DPDNOW

dpdnow.duckdns.org:8452

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-A34JIZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

stealc

Botnet

tale

http://185.215.113.206

Attributes

url_path
/6c4adf523b719729.php

Extracted

Family

lumma

https://founpiuer.store/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	956e7b56a5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ada753f404.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	remcos_a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	remcos.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	remcos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ada753f404.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	956e7b56a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	remcos_a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	remcos_a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	remcos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ada753f404.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	956e7b56a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	remcos_a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	buildd.exe

Executes dropped EXE 9 IoCs

pid	Process
5040	skotes.exe
3644	remcos_a.exe
1172	remcos.exe
2940	buildd.exe
4600	ada753f404.exe
4484	956e7b56a5.exe
1892	skotes.exe
2760	skotes.exe
4848	skotes.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	remcos.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	remcos_a.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	ada753f404.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	956e7b56a5.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ada753f404.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004507001\\ada753f404.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\956e7b56a5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004508001\\956e7b56a5.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos_a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-A34JIZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos_a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
4408	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
5040	skotes.exe
3644	remcos_a.exe
1172	remcos.exe
4600	ada753f404.exe
4484	956e7b56a5.exe
1892	skotes.exe
2760	skotes.exe
4848	skotes.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4328	4600	WerFault.exe	110
372	4600	WerFault.exe	110
1364	4600	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos_a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ada753f404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	956e7b56a5.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2256	cmd.exe
2332	netsh.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4204	timeout.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4408	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
4408	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
5040	skotes.exe
5040	skotes.exe
3644	remcos_a.exe
3644	remcos_a.exe
1172	remcos.exe
1172	remcos.exe
2940	buildd.exe
2940	buildd.exe
2940	buildd.exe
2940	buildd.exe
2940	buildd.exe
2940	buildd.exe
4600	ada753f404.exe
4600	ada753f404.exe
4484	956e7b56a5.exe
4484	956e7b56a5.exe
1892	skotes.exe
1892	skotes.exe
2760	skotes.exe
2760	skotes.exe
4848	skotes.exe
4848	skotes.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2940	buildd.exe
Token: SeAssignPrimaryTokenPrivilege	2940	buildd.exe
Token: SeIncreaseQuotaPrivilege	2940	buildd.exe
Token: SeSecurityPrivilege	2940	buildd.exe
Token: SeTakeOwnershipPrivilege	2940	buildd.exe
Token: SeLoadDriverPrivilege	2940	buildd.exe
Token: SeSystemtimePrivilege	2940	buildd.exe
Token: SeBackupPrivilege	2940	buildd.exe
Token: SeRestorePrivilege	2940	buildd.exe
Token: SeShutdownPrivilege	2940	buildd.exe
Token: SeSystemEnvironmentPrivilege	2940	buildd.exe
Token: SeUndockPrivilege	2940	buildd.exe
Token: SeManageVolumePrivilege	2940	buildd.exe
Token: 31	2940	buildd.exe
Token: 32	2940	buildd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4408	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1172	remcos.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 5040	4408	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe	88
PID 4408 wrote to memory of 5040	4408	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe	88
PID 4408 wrote to memory of 5040	4408	78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe	88
PID 5040 wrote to memory of 3644	5040	skotes.exe	94
PID 5040 wrote to memory of 3644	5040	skotes.exe	94
PID 5040 wrote to memory of 3644	5040	skotes.exe	94
PID 3644 wrote to memory of 1172	3644	remcos_a.exe	96
PID 3644 wrote to memory of 1172	3644	remcos_a.exe	96
PID 3644 wrote to memory of 1172	3644	remcos_a.exe	96
PID 5040 wrote to memory of 2940	5040	skotes.exe	97
PID 5040 wrote to memory of 2940	5040	skotes.exe	97
PID 2940 wrote to memory of 2256	2940	buildd.exe	98
PID 2940 wrote to memory of 2256	2940	buildd.exe	98
PID 2256 wrote to memory of 2976	2256	cmd.exe	100
PID 2256 wrote to memory of 2976	2256	cmd.exe	100
PID 2256 wrote to memory of 2332	2256	cmd.exe	101
PID 2256 wrote to memory of 2332	2256	cmd.exe	101
PID 2256 wrote to memory of 556	2256	cmd.exe	102
PID 2256 wrote to memory of 556	2256	cmd.exe	102
PID 2940 wrote to memory of 3500	2940	buildd.exe	103
PID 2940 wrote to memory of 3500	2940	buildd.exe	103
PID 3500 wrote to memory of 756	3500	cmd.exe	105
PID 3500 wrote to memory of 756	3500	cmd.exe	105
PID 3500 wrote to memory of 1348	3500	cmd.exe	106
PID 3500 wrote to memory of 1348	3500	cmd.exe	106
PID 3500 wrote to memory of 2388	3500	cmd.exe	107
PID 3500 wrote to memory of 2388	3500	cmd.exe	107
PID 5040 wrote to memory of 4600	5040	skotes.exe	110
PID 5040 wrote to memory of 4600	5040	skotes.exe	110
PID 5040 wrote to memory of 4600	5040	skotes.exe	110
PID 2940 wrote to memory of 4180	2940	buildd.exe	111
PID 2940 wrote to memory of 4180	2940	buildd.exe	111
PID 4180 wrote to memory of 1116	4180	cmd.exe	113
PID 4180 wrote to memory of 1116	4180	cmd.exe	113
PID 4180 wrote to memory of 4204	4180	cmd.exe	114
PID 4180 wrote to memory of 4204	4180	cmd.exe	114
PID 5040 wrote to memory of 4484	5040	skotes.exe	122
PID 5040 wrote to memory of 4484	5040	skotes.exe	122
PID 5040 wrote to memory of 4484	5040	skotes.exe	122
PID 5040 wrote to memory of 4764	5040	skotes.exe	123
PID 5040 wrote to memory of 4764	5040	skotes.exe	123
PID 5040 wrote to memory of 4764	5040	skotes.exe	123

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	buildd.exe

C:\Users\Admin\AppData\Local\Temp\78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe
"C:\Users\Admin\AppData\Local\Temp\78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Users\Admin\AppData\Local\Temp\1004494001\remcos_a.exe
    "C:\Users\Admin\AppData\Local\Temp\1004494001\remcos_a.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1172
- - C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe
    "C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2940
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:2256
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2976
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2332
    - - C:\Windows\system32\findstr.exe
        
        findstr /R /C:"[ ]:[ ]"
        5⤵
        
        PID:556
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3500
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:756
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1348
    - - C:\Windows\system32\findstr.exe
        
        findstr "SSID BSSID Signal"
        5⤵
        
        PID:2388
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1116
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4204
- - C:\Users\Admin\AppData\Local\Temp\1004507001\ada753f404.exe
    "C:\Users\Admin\AppData\Local\Temp\1004507001\ada753f404.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1512
      4⤵
      Program crash
      PID:4328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1468
      4⤵
      Program crash
      PID:372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1500
      4⤵
      Program crash
      PID:1364
- - C:\Users\Admin\AppData\Local\Temp\1004508001\956e7b56a5.exe
    "C:\Users\Admin\AppData\Local\Temp\1004508001\956e7b56a5.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4600 -ip 4600
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4600 -ip 4600
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4600 -ip 4600
1⤵
PID:552

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1892

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2760

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\logs.dat

Filesize
144B

MD5
2fd0ae47d647bd7d4f00ca6e7dcc3db5

SHA1
73a68ed4dbedd7b1b4d7107e49aca91e38e45939

SHA256
054b00cb6ca4e35e1ec39cd3950eb45a1ba6877808a97ade61753a66dbd96e84

SHA512
0e14517ea4acbe531e4d1f899765519eb2b5b39cfc98c7606d5b117601f860c8e00a1f76915fc18dd325880d9f527c3a58cfe713bb13b955abc3ef5fcef59cca

Download Submit
C:\Users\Admin\AppData\Local\Temp\1004494001\remcos_a.exe

Filesize
1.9MB

MD5
b85c47881ba0eb0b556b83827f8e75c8

SHA1
dccdf0daee468f9e9bed3edf928f0839d26b47cb

SHA256
9d577624acca69f5b4097a6882e934b026a344757cf5cf31f3341e643ed2ba20

SHA512
ca158aff36e4eeff5d1c263a79972dfa0aa7584132f12a3d301a5cc5c47b57309fe71b4837c7b8caa5022cb18529b565d6a0849acdabd1af939b76b48284a605

Download Submit
C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe

Filesize
154KB

MD5
c426f46f2c074eda8c903f9868be046d

SHA1
d0352482370beff107eb2b2f13e2de275fbc91c7

SHA256
7cba781d569196e89a86f10cee7d69918fe05df1461d1f0ed3426ccb2046002e

SHA512
97eed1bad31bd2e558d2cf6ff3c3026d828f561e2d1439f0daca420f53a3c6b1d59442f043357be9a33761a8e99ac935d08239d2e50811d47909cec8caad7c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\1004507001\ada753f404.exe

Filesize
3.0MB

MD5
8cf8b11e1553e2381b0c2376d013e951

SHA1
33d8bc52fe1fc709ee086a5a84d39024b6e2db92

SHA256
d3ea3d360b4e4c6bc1da5adbd8c8bbe689b0541166e2a77dac821517be81de98

SHA512
a876d770734998f8397efea36c94bf7b61d14aa317f4b9e62b95333171068b626ebe2336c6fefc3a0f02f16b454df5c852b9fe4cbb3af59fe1d11ae2f77303a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1004508001\956e7b56a5.exe

Filesize
2.0MB

MD5
5c656fca21313b706060727ffe93f6bb

SHA1
481b192814532355b6e2045091ee300f307349e8

SHA256
bfcf6c46d64eb87be63df45a15ff9c2a89bd66af62942756ec4dbd45cdfe6ebd

SHA512
a7035a9bfb230ed1621dfabcfa43ee07b62e95b82858f2cac1bdaba16c5654574f5af0f445082d5ba6695bc5734a8e0d99d05a810ba27344ec0fe709e20cd589

Download Submit
C:\Users\Admin\AppData\Local\Temp\1004510001\b7f1c4804d.exe

Filesize
32KB

MD5
e1c1caff464b2c9fcc4d6b2dcfdd3e09

SHA1
a9c7b611dd66633ee8cb63814345b547ba165ed2

SHA256
f3706b04ce8d4d1c10053c43e1ff502fec5a7add0c775fae8d6c336fb5c6145f

SHA512
94a180fec46920a431766e504e69666f3401e7faacdad6380a4a714731a4c82352a89945a3b040059c040e4d0ed4febd2fa04d90e8906c93295be0747fc1d5ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.2MB

MD5
7446e32ee2697758d8a5ed74e79bac34

SHA1
1e4beba935149218af721846c82fd17ca0a6ea7d

SHA256
78616f9a2871e1015580f8ac04e8ecff60d516e061e9b935dbea2bbbd63188fa

SHA512
e5f812d4fd08c46a838147bc6d50499080c1a992a59c8b135fae2974d01cabef509c0fe007af7e7839364cc541379b7df2936dcb8b1009732b71be73b73e87f7

Download Submit
memory/1172-112-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-51-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-188-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-184-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-180-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-146-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-176-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-149-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-172-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-168-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-109-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-157-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-141-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-161-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-194-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1172-153-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1892-139-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/1892-138-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/2760-165-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/2760-166-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/2940-73-0x00000139A6890000-0x00000139A68BC000-memory.dmp

Filesize
176KB

Download
memory/3644-53-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/3644-43-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/3644-39-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/4408-4-0x0000000000380000-0x00000000006AB000-memory.dmp

Filesize
3.2MB

Download
memory/4408-2-0x0000000000381000-0x00000000003E9000-memory.dmp

Filesize
416KB

Download
memory/4408-0-0x0000000000380000-0x00000000006AB000-memory.dmp

Filesize
3.2MB

Download
memory/4408-3-0x0000000000380000-0x00000000006AB000-memory.dmp

Filesize
3.2MB

Download
memory/4408-18-0x0000000000380000-0x00000000006AB000-memory.dmp

Filesize
3.2MB

Download
memory/4408-1-0x0000000077C54000-0x0000000077C56000-memory.dmp

Filesize
8KB

Download
memory/4408-19-0x0000000000381000-0x00000000003E9000-memory.dmp

Filesize
416KB

Download
memory/4484-111-0x0000000000B30000-0x0000000001259000-memory.dmp

Filesize
7.2MB

Download
memory/4484-110-0x0000000000B30000-0x0000000001259000-memory.dmp

Filesize
7.2MB

Download
memory/4600-115-0x00000000009A0000-0x0000000000CA4000-memory.dmp

Filesize
3.0MB

Download
memory/4600-91-0x00000000009A0000-0x0000000000CA4000-memory.dmp

Filesize
3.0MB

Download
memory/4848-192-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-41-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-174-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-136-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-159-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-143-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-163-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-74-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-54-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-40-0x00000000005F1000-0x0000000000659000-memory.dmp

Filesize
416KB

Download
memory/5040-38-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-155-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-147-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-170-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-178-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-22-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-182-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-20-0x00000000005F1000-0x0000000000659000-memory.dmp

Filesize
416KB

Download
memory/5040-186-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-21-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-190-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-151-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download
memory/5040-16-0x00000000005F0000-0x000000000091B000-memory.dmp

Filesize
3.2MB

Download