Analysis
-
max time kernel
148s -
max time network
128s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-11-2024 00:18
Static task
static1
Behavioral task
behavioral1
Sample
Slf.msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Slf.msi
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Slf.msi
Resource
win11-20241007-en
General
-
Target
Slf.msi
-
Size
3.4MB
-
MD5
6f92f923d8f87afe5fe757ff2ff56951
-
SHA1
44780713a7026b9b0ff3cadeaffacb3cc3584eca
-
SHA256
6ed0c218b751ec93293b5922e783b7a9b147a3c7cd6070022cd707050108d321
-
SHA512
100df666e8c5b4c2e21de703fe7210a41daedf1480e1fe4b7388aa63dd51eccbe46e141a275ef61061c97cf3cd268a129cfd5fa0e290e4525b07915789713f0a
-
SSDEEP
49152:vm5X8r6F5mCmR+juZZZL+H9IyKficUAG595WpZsNAaudSIuvLZ8:co6wZLSIX6cZGZWUNAaudgZ
Malware Config
Extracted
remcos
v2
185.157.162.126:1995
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
qsdazeazd-EL00KX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral3/files/0x001900000002ab45-53.dat family_hijackloader -
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
-
Hijackloader family
-
Remcos family
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3996 set thread context of 3288 3996 Updwork.exe 86 PID 4968 set thread context of 1756 4968 EHttpSrv.exe 83 PID 1756 set thread context of 3064 1756 cmd.exe 89 -
Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFD04148233B709BB2.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI904A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8FBB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8FEB.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF1B7AA800CA26067D.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF386929AF87E1A210.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFDE7A1986A03BAC31.TMP msiexec.exe File created C:\Windows\Installer\e5b8e13.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8E62.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8F7C.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5b8e13.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{BB2F3E18-3F04-450F-B8B5-60A9665181A8} msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 4968 EHttpSrv.exe 3996 Updwork.exe -
Loads dropped DLL 8 IoCs
pid Process 2152 MsiExec.exe 2152 MsiExec.exe 2152 MsiExec.exe 2152 MsiExec.exe 4968 EHttpSrv.exe 4968 EHttpSrv.exe 3996 Updwork.exe 3064 EHttpSrv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2308 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Updwork.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral3/files/0x001900000002ab4c-42.dat nsis_installer_1 behavioral3/files/0x001900000002ab4c-42.dat nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1916 msiexec.exe 1916 msiexec.exe 4968 EHttpSrv.exe 1756 cmd.exe 1756 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 4968 EHttpSrv.exe 1756 cmd.exe 1756 cmd.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 2308 msiexec.exe Token: SeIncreaseQuotaPrivilege 2308 msiexec.exe Token: SeSecurityPrivilege 1916 msiexec.exe Token: SeCreateTokenPrivilege 2308 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2308 msiexec.exe Token: SeLockMemoryPrivilege 2308 msiexec.exe Token: SeIncreaseQuotaPrivilege 2308 msiexec.exe Token: SeMachineAccountPrivilege 2308 msiexec.exe Token: SeTcbPrivilege 2308 msiexec.exe Token: SeSecurityPrivilege 2308 msiexec.exe Token: SeTakeOwnershipPrivilege 2308 msiexec.exe Token: SeLoadDriverPrivilege 2308 msiexec.exe Token: SeSystemProfilePrivilege 2308 msiexec.exe Token: SeSystemtimePrivilege 2308 msiexec.exe Token: SeProfSingleProcessPrivilege 2308 msiexec.exe Token: SeIncBasePriorityPrivilege 2308 msiexec.exe Token: SeCreatePagefilePrivilege 2308 msiexec.exe Token: SeCreatePermanentPrivilege 2308 msiexec.exe Token: SeBackupPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeShutdownPrivilege 2308 msiexec.exe Token: SeDebugPrivilege 2308 msiexec.exe Token: SeAuditPrivilege 2308 msiexec.exe Token: SeSystemEnvironmentPrivilege 2308 msiexec.exe Token: SeChangeNotifyPrivilege 2308 msiexec.exe Token: SeRemoteShutdownPrivilege 2308 msiexec.exe Token: SeUndockPrivilege 2308 msiexec.exe Token: SeSyncAgentPrivilege 2308 msiexec.exe Token: SeEnableDelegationPrivilege 2308 msiexec.exe Token: SeManageVolumePrivilege 2308 msiexec.exe Token: SeImpersonatePrivilege 2308 msiexec.exe Token: SeCreateGlobalPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe Token: SeRestorePrivilege 1916 msiexec.exe Token: SeTakeOwnershipPrivilege 1916 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2308 msiexec.exe 2308 msiexec.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2152 1916 msiexec.exe 80 PID 1916 wrote to memory of 2152 1916 msiexec.exe 80 PID 1916 wrote to memory of 2152 1916 msiexec.exe 80 PID 1916 wrote to memory of 4968 1916 msiexec.exe 81 PID 1916 wrote to memory of 4968 1916 msiexec.exe 81 PID 1916 wrote to memory of 4968 1916 msiexec.exe 81 PID 1916 wrote to memory of 3996 1916 msiexec.exe 82 PID 1916 wrote to memory of 3996 1916 msiexec.exe 82 PID 1916 wrote to memory of 3996 1916 msiexec.exe 82 PID 4968 wrote to memory of 1756 4968 EHttpSrv.exe 83 PID 4968 wrote to memory of 1756 4968 EHttpSrv.exe 83 PID 4968 wrote to memory of 1756 4968 EHttpSrv.exe 83 PID 3996 wrote to memory of 3288 3996 Updwork.exe 86 PID 3996 wrote to memory of 3288 3996 Updwork.exe 86 PID 3996 wrote to memory of 3288 3996 Updwork.exe 86 PID 3996 wrote to memory of 3288 3996 Updwork.exe 86 PID 3996 wrote to memory of 3288 3996 Updwork.exe 86 PID 4968 wrote to memory of 1756 4968 EHttpSrv.exe 83 PID 1756 wrote to memory of 3064 1756 cmd.exe 89 PID 1756 wrote to memory of 3064 1756 cmd.exe 89 PID 1756 wrote to memory of 3064 1756 cmd.exe 89 PID 1756 wrote to memory of 3064 1756 cmd.exe 89 PID 1756 wrote to memory of 3064 1756 cmd.exe 89
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Slf.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2308
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F6B69BF4CCD323538166F3672BFC57122⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2152
-
-
C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe"C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exeC:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3064
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Updwork.exe"C:\Users\Admin\AppData\Local\Temp\Updwork.exe"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\System32\WerFault.exe"3⤵PID:3288
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- System Location Discovery: System Language Discovery
PID:2788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD594246d0fc97edd83f70f5cab7eceffce
SHA1681223694fe76556ba93867397b217477923b562
SHA256121e2c4deeb74b175cb1558a2d2b89e737ad0914f688f8134f235d2700449808
SHA512cee8d48df746d37bb2616496c515467b01597bdebaac75b26fc1f3a27d82b2d7e72e15d781ad8c6c59d0bcbdd539d80daea01e1fd10d4c5126718f6673860dd9
-
Filesize
20KB
MD59329ba45c8b97485926a171e34c2abb8
SHA120118bc0432b4e8b3660a4b038b20ca28f721e5c
SHA256effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659
SHA5120af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc
-
Filesize
20KB
MD5f3985d29a01d82bd2b5965705dae6697
SHA19d0bc0a1fa286b5b86bbf83ead221db4b1d8796e
SHA2569723576ae86355134e20d0e355d1896fec2950fad51d8991db0f3a20564b0791
SHA512ffa501f6803620534d2569dda2381cacaceeff052ea1b383d5071e3343f451016183a347c569eaaa43e19203656efffd94e094bee081e5914e705eb5d6726af7
-
Filesize
363KB
MD53ca940e27e87443f7891d39536650f9b
SHA12603ff220c43f13591a51abb0cf339aecb758207
SHA256a91f13aece1ea7ebe326f0e340bda9d00613d3365cd81b7f138a4c9446ffbd38
SHA5120c0e04cbb8247f6dfe0790d1c3453596e3cb5f5ff0d2c3bc4e01fb38ad8e042322130072263c135c5637a745ef70ac68487bdade3510990ce8f609cad46566ee
-
Filesize
494KB
MD5253c52411b256e4af301cba58dcb6cef
SHA1f21252c959b9eb47cd210f41b997cf598612d7c9
SHA2567d57b704dd881413e7ee2effb3d85bdfff1e208b0f3f745419e640930d9d339d
SHA51240de728edae55f97ac9459cf78bbc31b38e8b59bdb7a74fbd9e09d7efd2a81b1dc5fd8011007c66efb58e850f1c57d099ec340aecd62911d6aebf2e70d1275d0
-
Filesize
877KB
MD55124236fd955464317fbb1f344a1d2f2
SHA1fe3a91e252f1dc3c3b4980ade7157369ea6f5097
SHA256ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6
SHA5122b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252
-
Filesize
1.0MB
MD528aaba3d964b188a870cef88cb147fd5
SHA147437296b1f89ba17c46fd3206afe9735f961523
SHA256b468cedce8aa04ac49703abce990dc66b46e14c3d30eab5dac2ec5650713f4e5
SHA512256d7b44b42bc4b5188e876ce174c93826b208d6c134db1573b136842cdf7e45401b4061d0bf93a4f96cd432d6619d45e087836cc8a42bc7b72228901ab5bbde
-
Filesize
883KB
MD54366cd6c5d795811822b9ccc3df3eab4
SHA130f6050729b4c08b7657454cb79dd5a3d463c606
SHA25655497a3eced5d8d190400bcd1a4b43a304ebf74a0d6d098665474ed4b1b0e9da
SHA5124a56a2da7ded16125c2795d5760c7c08a93362536c9212cff3a31dbf6613cb3fca436efd77c256338f5134da955bc7ccc564b4af0c45ac0dfd645460b922a349
-
Filesize
1.0MB
MD5686b224b4987c22b153fbb545fee9657
SHA1684ee9f018fbb0bbf6ffa590f3782ba49d5d096c
SHA256a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36
SHA51244d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875
-
Filesize
557KB
MD52c9c51ac508570303c6d46c0571ea3a1
SHA1e3e0fe08fa11a43c8bca533f212bdf0704c726d5
SHA256ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550
SHA512df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127