Malware Analysis Report

2024-11-13 17:39

Sample ID 241107-sgjreatnb1
Target 1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1
SHA256 1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1
Tags
discovery guloader remcos remotehost collection downloader rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1

Threat Level: Known bad

The file 1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1 was found to be: Known bad.

Malicious Activity Summary

discovery guloader remcos remotehost collection downloader rat spyware stealer

Remcos

Guloader,Cloudeye

Remcos family

Guloader family

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 15:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-07 15:05

Reported

2024-11-07 15:08

Platform

win7-20241023-en

Max time kernel

119s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 224

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-07 15:05

Reported

2024-11-07 15:08

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

148s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2612 wrote to memory of 3288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2612 wrote to memory of 3288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2612 wrote to memory of 3288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3288 -ip 3288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 15:05

Reported

2024-11-07 15:08

Platform

win7-20240903-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

Signatures

Guloader family

guloader

Guloader,Cloudeye

downloader guloader

Remcos

rat remcos

Remcos family

remcos

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\karga.ini C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2888 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2888 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2888 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2888 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2888 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2888 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 2640 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\ngssjweqvazwc"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\xaxlkppkjirbnpbz"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\iccvlhalxqjopvxdlqno"

Network

Country Destination Domain Proto
US 212.162.149.211:80 212.162.149.211 tcp
US 212.162.149.220:2404 tcp
US 212.162.149.220:2404 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp

Files

\Users\Admin\AppData\Local\Temp\nsy63C3.tmp\System.dll

MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

memory/2888-27-0x0000000004090000-0x00000000059BC000-memory.dmp

memory/2888-28-0x0000000076DF1000-0x0000000076EF2000-memory.dmp

memory/2888-29-0x0000000076DF0000-0x0000000076F99000-memory.dmp

memory/2640-30-0x0000000076DF0000-0x0000000076F99000-memory.dmp

memory/2888-31-0x0000000004090000-0x00000000059BC000-memory.dmp

memory/2640-32-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-36-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2080-38-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2080-42-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1628-48-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1628-49-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1628-50-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1628-47-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1628-46-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2068-45-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2080-44-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2068-43-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2068-41-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2080-40-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2068-39-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2080-56-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ngssjweqvazwc

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2068-60-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2640-62-0x0000000032840000-0x0000000032859000-memory.dmp

memory/2640-66-0x0000000032840000-0x0000000032859000-memory.dmp

memory/2640-65-0x0000000032840000-0x0000000032859000-memory.dmp

memory/2640-68-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-71-0x0000000000490000-0x00000000014F2000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 c6b71547134741c62e050a2f69cc0997
SHA1 e4164e175066dce7dfea17df845727fcbac3d75a
SHA256 ea5cfc318a0c684584967934dc5294fd2db64e4e452d9ef50f235772c7509993
SHA512 6d03c3520ee8d150ef695f4c9852746915b0c7324cb3e6103e94fc7d8c518de23cd257340fa7e453fe9d76744d5632308852e72587c7d661ff2eda88e68bc504

memory/2640-74-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-77-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-80-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-83-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-86-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-89-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-92-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-95-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-98-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-101-0x0000000000490000-0x00000000014F2000-memory.dmp

memory/2640-104-0x0000000000490000-0x00000000014F2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 15:05

Reported

2024-11-07 15:08

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

Signatures

Guloader family

guloader

Guloader,Cloudeye

downloader guloader

Remcos

rat remcos

Remcos family

remcos

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\karga.ini C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1968 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 1968 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 1968 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 1968 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 1968 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3764 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3764 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3764 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3764 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3764 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3764 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3764 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3764 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe
PID 3764 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

"C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\tsxbrxfendwmqxpbflaeho"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\wmcurpxgblozbelfovnfstwbhq"

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe

C:\Users\Admin\AppData\Local\Temp\1f785691c057f5062ac9d630cf304ad946c825928c87e63172f335e96beddda1.exe /stext "C:\Users\Admin\AppData\Local\Temp\gpimkiizptgedszjfgzzdgqkhwjbk"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 212.162.149.211:80 212.162.149.211 tcp
US 8.8.8.8:53 211.149.162.212.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 212.162.149.220:2404 tcp
US 212.162.149.220:2404 tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 220.149.162.212.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsw7D4F.tmp\System.dll

MD5 fc3772787eb239ef4d0399680dcc4343
SHA1 db2fa99ec967178cd8057a14a428a8439a961a73
SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
SHA512 79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

memory/1968-25-0x0000000004A20000-0x000000000634C000-memory.dmp

memory/1968-26-0x0000000077C21000-0x0000000077D41000-memory.dmp

memory/1968-27-0x0000000010004000-0x0000000010005000-memory.dmp

memory/1968-28-0x0000000004A20000-0x000000000634C000-memory.dmp

memory/3764-29-0x00000000016F0000-0x000000000301C000-memory.dmp

memory/3764-30-0x0000000077CA8000-0x0000000077CA9000-memory.dmp

memory/3764-31-0x0000000077CC5000-0x0000000077CC6000-memory.dmp

memory/3764-34-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-36-0x00000000016F0000-0x000000000301C000-memory.dmp

memory/4068-38-0x0000000000400000-0x0000000000478000-memory.dmp

memory/4068-43-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1424-46-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3320-51-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3320-59-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3320-56-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3764-55-0x0000000077C21000-0x0000000077D41000-memory.dmp

memory/3320-52-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3764-39-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3320-53-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1424-47-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4068-45-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1424-44-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1424-41-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1424-42-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4068-63-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tsxbrxfendwmqxpbflaeho

MD5 75379d3dcbcea6a69bc75b884816dd40
SHA1 7e073a03c3bdbbc60375ddbe56bba211c3d412a6
SHA256 cab559f3bbe4a0beb194dffca723b3072184b92687100462eaab04d66fff8de9
SHA512 710c2cee369a57a0039fc0d0c59de6118780210ef60ad0daf374f03ba94ab08039bc2aff821f7c99a0ecd0e16189c52e5b6d630b3d541f7b11375f134b985e8c

memory/3764-65-0x0000000034000000-0x0000000034019000-memory.dmp

memory/3764-68-0x0000000034000000-0x0000000034019000-memory.dmp

memory/3764-69-0x0000000034000000-0x0000000034019000-memory.dmp

memory/3764-72-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-75-0x0000000000490000-0x00000000016E4000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 cd6ce4760f61cf00cccad4d84824f3ce
SHA1 fc2b0bf56df51f7e58f9fa07ddae518b0ff46632
SHA256 3e6991f699e4840c5b8f449ac8c93121aef7e21d633070fd1957c75fa221018b
SHA512 d2d01008588fc82439fd8fa2d5250372cd4a9558800636c0c1c22898050458ae2d107401b0500f95c42489b9186297b2a6078fd94b6a789c40d37bfdb9bc553a

memory/3764-78-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-81-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-84-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-87-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-90-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-93-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-102-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-105-0x0000000000490000-0x00000000016E4000-memory.dmp

memory/3764-108-0x0000000000490000-0x00000000016E4000-memory.dmp