Malware Analysis Report

2024-11-13 17:38

Sample ID 241107-cmcbhstane
Target 1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
SHA256 1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1
Tags
guloader remcos remotehost collection discovery downloader rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1

Threat Level: Known bad

The file 1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe was found to be: Known bad.

Malicious Activity Summary

guloader remcos remotehost collection discovery downloader rat spyware stealer

Remcos

Guloader family

Remcos family

Guloader,Cloudeye

NirSoft WebBrowserPassView

Detected Nirsoft tools

NirSoft MailPassView

Reads user/profile data of web browsers

Loads dropped DLL

Accesses Microsoft Outlook accounts

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 02:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 02:11

Reported

2024-11-07 02:13

Platform

win7-20240903-en

Max time kernel

149s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

Signatures

Guloader family

guloader

Guloader,Cloudeye

downloader guloader

Remcos

rat remcos

Remcos family

remcos

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\karga.ini C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2292 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2292 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2292 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2292 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2292 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2292 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2232 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\ritmcziewfrycpvmto"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\bkyeustfkojdmdrqcztpr"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\memxvkezywbiojfcmcnquokd"

Network

Country Destination Domain Proto
US 212.162.149.211:80 212.162.149.211 tcp
US 212.162.149.220:2404 tcp
US 212.162.149.220:2404 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

\Users\Admin\AppData\Local\Temp\nstC746.tmp\System.dll

MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

memory/2292-27-0x0000000004000000-0x000000000592C000-memory.dmp

memory/2292-28-0x0000000077461000-0x0000000077562000-memory.dmp

memory/2292-29-0x0000000077460000-0x0000000077609000-memory.dmp

memory/2232-30-0x0000000077460000-0x0000000077609000-memory.dmp

memory/2292-31-0x0000000004000000-0x000000000592C000-memory.dmp

memory/2232-32-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-36-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2740-39-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2744-40-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2740-44-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2812-49-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2812-48-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2812-47-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2744-45-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2744-43-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2740-42-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2744-41-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2812-52-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2740-57-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ritmcziewfrycpvmto

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2232-61-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2744-64-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2232-65-0x0000000032980000-0x0000000032999000-memory.dmp

memory/2232-68-0x0000000032980000-0x0000000032999000-memory.dmp

memory/2232-69-0x0000000032980000-0x0000000032999000-memory.dmp

memory/2232-72-0x0000000000490000-0x00000000014F2000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 b2d2831e505e831b1c16a66f42b7e3a9
SHA1 303ff85c1e2fd8bb3449394c28d844fc27bca026
SHA256 8b8fc8769dd5c3d1cb52a43cb9d76a57fb538d4de7eec0d0cf9ac20c55f9587b
SHA512 f7d5087c66bea895596f2eb6d6645565359afe67e8fee15acf0469fa9bc443ee8c01e89640d476c2f6bfaf3cc691f700e11a09a48ccee18aee932f62aab2c808

memory/2232-75-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-78-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-80-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-83-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-86-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-89-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-93-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-96-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-99-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-101-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2232-104-0x0000000000490000-0x00000000014F2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 02:11

Reported

2024-11-07 02:13

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

Signatures

Guloader family

guloader

Guloader,Cloudeye

downloader guloader

Remcos

rat remcos

Remcos family

remcos

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\karga.ini C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4236 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 4236 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 4236 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 4236 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 4236 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3112 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3112 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3112 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3112 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3112 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3112 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3112 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3112 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3112 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\zsmrjcrbtekpzhqyjqdkkigsmzg"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\jmrbcvcchmcuknecsbqlvvbjugqowx"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\mpxucnnwduuzmcaokmknxavsdmixpibtr"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 212.162.149.211:80 212.162.149.211 tcp
US 8.8.8.8:53 211.149.162.212.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 212.162.149.220:2404 tcp
US 8.8.8.8:53 220.149.162.212.in-addr.arpa udp
US 212.162.149.220:2404 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsbB0D2.tmp\System.dll

MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

memory/4236-25-0x0000000004A30000-0x000000000635C000-memory.dmp

memory/4236-26-0x00000000772D1000-0x00000000773F1000-memory.dmp

memory/4236-27-0x0000000010004000-0x0000000010005000-memory.dmp

memory/4236-28-0x0000000004A30000-0x000000000635C000-memory.dmp

memory/3112-29-0x00000000016F0000-0x000000000301C000-memory.dmp

memory/3112-30-0x0000000077358000-0x0000000077359000-memory.dmp

memory/3112-31-0x0000000077375000-0x0000000077376000-memory.dmp

memory/3112-32-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3112-36-0x00000000016F0000-0x000000000301C000-memory.dmp

memory/3112-38-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3356-39-0x0000000000400000-0x0000000000478000-memory.dmp

memory/4376-51-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4376-50-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4376-53-0x0000000000400000-0x0000000000424000-memory.dmp

memory/4376-49-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3356-47-0x0000000000400000-0x0000000000478000-memory.dmp

memory/3116-46-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3356-45-0x0000000000400000-0x0000000000478000-memory.dmp

memory/3116-44-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3112-43-0x00000000772D1000-0x00000000773F1000-memory.dmp

memory/3116-42-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3116-48-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3116-40-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3356-62-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zsmrjcrbtekpzhqyjqdkkigsmzg

MD5 562a58578d6d04c7fb6bda581c57c03c
SHA1 12ab2b88624d01da0c5f5d1441aa21cbc276c5f5
SHA256 ff5c70287ba432a83f9015209d6e933462edca01d68c53c09882e1e4d22241c8
SHA512 3f6e19faa0196bd4c085defa587e664abdd63c25ef30df8f4323e60a5a5aca3cd2709466f772e64ab00fe331d4264841422d6057451947f3500e9252a132254e

memory/3112-68-0x0000000034000000-0x0000000034019000-memory.dmp

memory/3112-67-0x0000000034000000-0x0000000034019000-memory.dmp

memory/3112-64-0x0000000034000000-0x0000000034019000-memory.dmp

memory/3112-71-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3112-74-0x0000000000490000-0x00000000016E4000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 463c5812eceb98234dfdc3dc344feb46
SHA1 06cf4bad9272371ca9992c785bcc4787c1b16ec5
SHA256 ec974c2122481f24eb6b31248373a3173c3be7adffa8bf4d15cfd3556341d403
SHA512 adef9fe1a9738ebc19a65053a85f3b29b5fbc5326371890e2328328e5cf7229705ab50fa2acb9b24e19c5dc7b00d86c574ab3146693e5a71f19576adde0498bd

memory/3112-77-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3112-80-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3112-92-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3112-95-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3112-98-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3112-101-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3112-104-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3112-107-0x0000000000490000-0x00000000016E4000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-07 02:11

Reported

2024-11-07 02:13

Platform

win7-20240729-en

Max time kernel

119s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 224

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-07 02:11

Reported

2024-11-07 02:13

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1628 wrote to memory of 4464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1628 wrote to memory of 4464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1628 wrote to memory of 4464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4464 -ip 4464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 105.208.201.84.in-addr.arpa udp

Files

N/A