Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-11-2024 21:18
General
-
Target
465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0.exe
-
Size
1.9MB
-
MD5
910327e1694532d09255bd8873c2265b
-
SHA1
d8ff879532a00a57eacd8d54cce38653b515d861
-
SHA256
465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0
-
SHA512
680e0dd725dfa2a5ab6ce508567f10a7bf4779c662c0dfb83db4077df83b0b5c132f41cbb3c68efa00077bcaf71ce1ab648301d3da97b406d76ceee9c5bd7d4c
-
SSDEEP
49152:Jswg4gfCUU/mW7Mi8Q1ogJ2U91vwmlRbQhfAu7RPq:ewg4gfc/m9inJy8RbQCu7RP
Malware Config
Extracted
remcos
ms-office
ms-office.duckdns.org:39438
ms-office1.duckdns.org:39439
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-MXJN22
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
-
Hawkeye family
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Detected Nirsoft tools 9 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 34 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0.exe"C:\Users\Admin\AppData\Local\Temp\465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\System32\dxdiag.exe" /t C:\Users\Admin\AppData\Local\Temp\sysinfo.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0.exeC:\Users\Admin\AppData\Local\Temp\465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\xghypgbzjhwtoxqfinsxgi"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0.exeC:\Users\Admin\AppData\Local\Temp\465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\zinjqzmaxpoyyemrryfzjvzmwk"2⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0.exeC:\Users\Admin\AppData\Local\Temp\465b3ea1a625728238b4d832b54b6fdc9321bd638ebd483ebecf2b8e32c322e0.exe /stext "C:\Users\Admin\AppData\Local\Temp\jcabrrxutxglakavijrsuzuvershn"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD51a122c16a0b141680918f8bb6ad5f439
SHA14a049d86cc25d5fe1ea4ff32a62a7f84688d6b1b
SHA25670797f96b9bb7941e7c484d49a5c803ddd344c0fda7aa979b8a8b78b59a67a61
SHA51201bf10c5cb73e6a44a28f79bce1e738d38ac6d866a20bdf76111079da9d05fc72fa39576081617064cb561fbcbee294ee04967606618bf4b27283d46e8277a4f
-
Filesize
15KB
MD5aac6612fb505dc34b8bc279b3137bbfb
SHA1194f2c9ee9ce607bd1f4a00507d887858fb3a72a
SHA25655c9d4f2335affe64562372a455b575474b9da2f325c517996c0b144fc194f89
SHA5123f247615f0cb790c5f209bacbb6143534eb88a8ded2177be4478fa46fa2f998f9adc7e350998dd3433bc25cc5644d07ecfd328d8f732d6b697f7efa2bc4343ec
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
1.5MB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
100KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
4.9MB
-
Filesize
8KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
236KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
392KB
-
Filesize
1.5MB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
168KB
-
Filesize
40KB
-
Filesize
168KB
-
Filesize
40KB
-
Filesize
368KB
-
Filesize
368KB
-
Filesize
368KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB