Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-12-2024 16:03
General
-
Target
Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe
-
Size
759KB
-
MD5
e1dc71be5b3466d47a4934013be9b604
-
SHA1
4c6627a901ade3b1f0cd6a233085deb7e044ef97
-
SHA256
1352efe35374bcc94f0b4e189761610a8620ff63aad350060a806773c969fd53
-
SHA512
a44f75ea0eac848dd2b724b9a50fb5b0259382f61a047563689381e3a60fc07547c209b2acdddcb1dae371cdf51f0065e2a89ff0276299c0d72928af87c9aafc
-
SSDEEP
12288:GtomEHbPQsIbw8Z9TzDBWzowh0Nxj5gUZVroN64V23i3Qo+eSp5:TN7PXIdZlDBWUrx5gAVroNFHzU
Malware Config
Extracted
remcos
RemoteHost
162.251.122.87:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-UOMZ21
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Detected Nirsoft tools 8 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe"C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe"C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe"C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fxjokfizxtiosoxdnqdmbonrzfwsfxifl"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe"C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe" /stext "C:\Users\Admin\AppData\Local\Temp\paozcx"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe"C:\Users\Admin\AppData\Local\Temp\Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe" /stext "C:\Users\Admin\AppData\Local\Temp\auusdqeuz"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5bdd80cd9708c717edc5e82ca37d7130b
SHA17c77815d424a1d6529de98124e35335193168bf3
SHA256799d2b1d8340de661998a59e8383500111140c34e27dc5eb22b1df7405b20f11
SHA512b2e50cfdbf6fff93d7aaa0e6d06c69d1563adb5c4abdfe81912f6b0f5bbfb1c9877261b68cbb20c12941ada45a4e311610097068cde9e915ea14aec73622f041
-
Filesize
4KB
MD5c3c5f2de99b7486f697634681e21bab0
SHA100f90d495c0b2b63fde6532e033fdd2ade25633d
SHA25676296dc29f718988107d35d0e0b835c2bf3fc7405e79e5121aa4738f82b51582
SHA5127c60ffdc093de30e793d20768877f2f586bee3e948767871f9a1139252d5d2f593ba6f88ce0ed5f72c79faddb26186792df0581e4b6c84d405c44d9d12f951b8
-
Filesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
Filesize
15B
MD5232ea7835f5abeffc769949d0bad82bf
SHA1d8183e34d3c48afb0f7598a4dc11182218d7e9fe
SHA256384e1fc0d130aa5cbfa9077f6de89b555e096afb67cd2dd827933b992549e69c
SHA512e552cc1f310029859899ab726b70ef38c08026af5e0c125c58e9b31005d8c2fd2d636d8bb3aaf8a039aa3450f058c038186da34b63e883e3613049a6df6905e4
-
Filesize
21B
MD52dc5ae451f6175ae513bed5c4714d5ee
SHA14f47723723e7643a5b4c67f5f9d68cd834f80a4f
SHA256180f6fc17f1d6e7d0878868f1643dc8c340f457eac0d6fc3680a95f1f9e7e54e
SHA5129140fa690eca23bdf03d3058e6527c56cd51089b394ef681979f8e63cdc183fa942aecfd2d1061f50966fb998a5c0999b97b5b3a9af6aff1ce1d4826cfd42887
-
Filesize
23B
MD5742d3f392842fd0a5ebecea567c2af34
SHA1b680bc716a2b53ef6af5edcbf222e6ac2606e1e8
SHA256c7c952a7580d506f694240eb56e705a182561523c14116ab5aab1c2c87f886bf
SHA5121642176efc91de80dd89412d982f8c9b1b53a0c96067fdbb70cc04a94c0d37d18caee0bdfab9666930af4e50ad37fdb5335e58c210b67fa59420044d4130aedf
-
Filesize
12B
MD5f55b9d6e5f20db4066c68219d6cc7244
SHA1b3a70fc3ea2da60d58274d9466a88a1e57926356
SHA2569c2c033694acd2ee629918b688ee91e0032e6d2fa5cbb6b39a13e50024e73e01
SHA51235bde19664ead683e639f42ed8447eab5bac8a1ac873efde467439e0631e3ece634b90e25140e62f46189df57f5c8fb6af44a8062ca9750514f8571d5860f2e1
-
Filesize
23B
MD58c367f7037d83ec5fc0be4bcd16dba9d
SHA10efc8b29b482afae9aaceef0d80a138ab9b527a9
SHA2566f470f6196119f505cd2d1b132c50c06fd6522bbd6ffc95b992212093221b637
SHA512356e4ee6b5572b174084957b61e2aaea850486e2c087b87019bcb7565013d86aadffdc1f3e70ec4c77be108519ce312a2db1896584a738d631c190c03f5fec56
-
Filesize
32B
MD5749841d5d4f33aa61da2072ca8c75d85
SHA1ed779369af6004bb662353a1a1688de21c9d5964
SHA25605ec837bf0f57ead1b3fae5bec24f103831be6946eda1fe4cec3700ae019b117
SHA51207884f39b2b1646dbad182d39167df36cb86fd3751b5c125b84ab3b3594dd0f6884d73f7f65d099e2874a0a73f8a76d7610b3ab30e174945a70073176e07b886
-
Filesize
41B
MD5088d509592627d226179707a88a1f4ee
SHA18c03f8a469d4dc4e7f65da8daa8c0e9cdebbe9f4
SHA2567938b90dbe50e63bd3bc2b7ae77d43ba7c01c15354ab01f9a0b63ebac56b796d
SHA512f36c70cbb4dbb09a8081b472ceb712b983a676d5a34dc19ec4d0d95126c4e6b80cdd66640e304eb35445503255c9aac22edf386bf6782151844e8df4e1874d5f
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
37B
MD5fee1a5ccd345e931c7fa183fb90669c8
SHA1feccc85f260d7ceb016fedf3546a22073b58cce0
SHA25610112c27d1a291095f738b379cb8fbea6acdd2419ff4e44981f4a8df7ff8466e
SHA5120076356776acd6c645ae954b6c1c70e60fb555f02daf1e1ff9c639c1bdf74afa80926d6482cb9669aba46db082180af05615ab149708070c48043324478d1289
-
Filesize
43B
MD544f5faa6c32983c85a139e1a0263c602
SHA1027ea1b136e708edbe28aadcfcc9fe02468175d2
SHA256d7824479f1abbfbe5a5b2386ae7bf867746adbb62eb2df88b92037c2d1e9a431
SHA5122394ef0bf4670037dda86caf4254d68942500e626d556aa69b8b9bf24f3e7be5838be6c108e4933362008b34561e530e5d15badffe9b322e17b92231d4f18c37
-
Filesize
60B
MD533714fd37d9159cf4911fe47896b9e69
SHA177c9ddfb1cd8e4a9a0a9131d0d21ebac0ef57611
SHA2568eda392d2cd028b1a3385ff7673cade57e402248db7fe7eb192e8d6b0d8f78a2
SHA512e4abaa9b5e706647dfe0174daa5164d0464f7ee971c5ee2983e28a4d2062eda2d0d9468340ebdbe6110b33958a9b3256757c3e5557b3ef617fe76ce576b8ba0a
-
Filesize
56B
MD524c65563d17054b07c6135e87a53cffd
SHA14765777312bf6c4c7272e61b4dbbce3202bb2d68
SHA256e145085a50e8790798362058aa0b197b97b8ae38a54ff47ee89fd00dec4f47ce
SHA512f6419106a5e5d864da20840817f473556140fc982e271380c3eed2a5be03c2dc68fb69ab1b2ba5698dec4ca477377e53c589f9b280faf436dd94767e5d0cb15f
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
16B
MD5433fcfa8e075cbbb3370cb2f6c4658da
SHA1c7926411bd50f5556bfbea60e7d81931e1aad868
SHA256ccaabed14663822955f3eed5f5ebac067cbb8c0ff9734a67d30fb94a14826237
SHA5121306f8e4430ed4e981b775409e14d7f927aa630c2bf89b42949fd9ba11b6aceaba61d2bebc925ebc4a7fb4ac2f9add8677f2f579b591639c0b5950fa68f64ee0
-
Filesize
19B
MD5a82a5da452642ddab3a7ee07f7c408df
SHA1cf937f2e7e57c21beaf57a2b7e0c4b77f37c63f7
SHA25684911471a6124a186d240b3b67eed83ba5a0a7cb911eefc790712d936c83d568
SHA51273ed822f62f762e6e8902b4a5c31ea9a0501926d2dd512f5e5285d39fa8b31e82e61294c99c341e0f2046d0cb0351396e8d97afc0ddc71d37c9b680cf757f5a0
-
Filesize
26B
MD5bc970bd8ec8acf8ac1ada9e444673a39
SHA16c03dfa1c2595129e8e0e2428fceb0f2df7f82a7
SHA2560092de36b51381e4fe5e613bdbae906f0c6e8691fec4a93f82b876f1af826648
SHA512c3fc2d8b396b6753759b532bb9e91d015a039476ec2cf8abcd4c6d4d32b9305146752743692486bd4e3984325a7e9c6db0ff4d902c2879993789573f9cdca3b0
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
14.5MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
14.5MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
14.5MB
-
Filesize
1.1MB
-
Filesize
14.5MB
-
Filesize
4KB
-
Filesize
14.5MB