Analysis
-
max time kernel
299s -
max time network
291s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-01-2025 13:45
Static task
static1
Behavioral task
behavioral1
Sample
10012025_1345_10012025_2025-10-01.rtf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
10012025_1345_10012025_2025-10-01.rtf
Resource
win10v2004-20241007-en
General
-
Target
10012025_1345_10012025_2025-10-01.rtf
-
Size
468KB
-
MD5
637a0dca5ff05243ce500f663899f348
-
SHA1
0a8dc1c0ebaa9a6543b49bc2c6546c48a89a92c8
-
SHA256
9847787ffbd118169e46e25faf174e06acda93a9bd3a05253e395248a14c90e4
-
SHA512
84eb867a3a83748deb213d485c5e2b7d2c2476b1bd34a59066a6930a9dc665e425675dd152cdbbbd94553af9c0e69149b12d5330bb8f7e775285298f876abc8c
-
SSDEEP
6144:bwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAi:5Tpy
Malware Config
Extracted
remcos
RemoteHost
www.kposlifestyle.design:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
edefdefffff
-
mouse_option
false
-
mutex
Rmc-OH1QS4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2464-73-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/1756-77-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/2272-79-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/2464-73-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/1756-77-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Blocklisted process makes network request 2 IoCs
flow pid Process 4 2968 EQNEDT32.EXE 7 2968 EQNEDT32.EXE -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2776 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
pid Process 2764 firefoxplugni.exe 2704 firefoxplugni.exe 1756 firefoxplugni.exe 2464 firefoxplugni.exe 2272 firefoxplugni.exe -
Loads dropped DLL 2 IoCs
pid Process 2968 EQNEDT32.EXE 2968 EQNEDT32.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts firefoxplugni.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2764 set thread context of 2704 2764 firefoxplugni.exe 35 PID 2704 set thread context of 1756 2704 firefoxplugni.exe 36 PID 2704 set thread context of 2464 2704 firefoxplugni.exe 37 PID 2704 set thread context of 2272 2704 firefoxplugni.exe 38 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefoxplugni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQNEDT32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefoxplugni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefoxplugni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefoxplugni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefoxplugni.exe -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 2968 EQNEDT32.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2904 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1756 firefoxplugni.exe 2776 powershell.exe 1756 firefoxplugni.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2704 firefoxplugni.exe 2704 firefoxplugni.exe 2704 firefoxplugni.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2272 firefoxplugni.exe Token: SeDebugPrivilege 2776 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2904 WINWORD.EXE 2904 WINWORD.EXE 2704 firefoxplugni.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2764 2968 EQNEDT32.EXE 30 PID 2968 wrote to memory of 2764 2968 EQNEDT32.EXE 30 PID 2968 wrote to memory of 2764 2968 EQNEDT32.EXE 30 PID 2968 wrote to memory of 2764 2968 EQNEDT32.EXE 30 PID 2904 wrote to memory of 2080 2904 WINWORD.EXE 32 PID 2904 wrote to memory of 2080 2904 WINWORD.EXE 32 PID 2904 wrote to memory of 2080 2904 WINWORD.EXE 32 PID 2904 wrote to memory of 2080 2904 WINWORD.EXE 32 PID 2764 wrote to memory of 2776 2764 firefoxplugni.exe 33 PID 2764 wrote to memory of 2776 2764 firefoxplugni.exe 33 PID 2764 wrote to memory of 2776 2764 firefoxplugni.exe 33 PID 2764 wrote to memory of 2776 2764 firefoxplugni.exe 33 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2764 wrote to memory of 2704 2764 firefoxplugni.exe 35 PID 2704 wrote to memory of 1756 2704 firefoxplugni.exe 36 PID 2704 wrote to memory of 1756 2704 firefoxplugni.exe 36 PID 2704 wrote to memory of 1756 2704 firefoxplugni.exe 36 PID 2704 wrote to memory of 1756 2704 firefoxplugni.exe 36 PID 2704 wrote to memory of 1756 2704 firefoxplugni.exe 36 PID 2704 wrote to memory of 2464 2704 firefoxplugni.exe 37 PID 2704 wrote to memory of 2464 2704 firefoxplugni.exe 37 PID 2704 wrote to memory of 2464 2704 firefoxplugni.exe 37 PID 2704 wrote to memory of 2464 2704 firefoxplugni.exe 37 PID 2704 wrote to memory of 2464 2704 firefoxplugni.exe 37 PID 2704 wrote to memory of 2272 2704 firefoxplugni.exe 38 PID 2704 wrote to memory of 2272 2704 firefoxplugni.exe 38 PID 2704 wrote to memory of 2272 2704 firefoxplugni.exe 38 PID 2704 wrote to memory of 2272 2704 firefoxplugni.exe 38 PID 2704 wrote to memory of 2272 2704 firefoxplugni.exe 38
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10012025_1345_10012025_2025-10-01.rtf"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2080
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Roaming\firefoxplugni.exe"C:\Users\Admin\AppData\Roaming\firefoxplugni.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\firefoxplugni.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Users\Admin\AppData\Roaming\firefoxplugni.exe"C:\Users\Admin\AppData\Roaming\firefoxplugni.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Roaming\firefoxplugni.exeC:\Users\Admin\AppData\Roaming\firefoxplugni.exe /stext "C:\Users\Admin\AppData\Local\Temp\myfphlsjtod"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1756
-
-
C:\Users\Admin\AppData\Roaming\firefoxplugni.exeC:\Users\Admin\AppData\Roaming\firefoxplugni.exe /stext "C:\Users\Admin\AppData\Local\Temp\wakaiddlhwvnbf"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:2464
-
-
C:\Users\Admin\AppData\Roaming\firefoxplugni.exeC:\Users\Admin\AppData\Roaming\firefoxplugni.exe /stext "C:\Users\Admin\AppData\Local\Temp\gvpsjwoevenamlfcd"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Exploitation for Client Execution
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264B
MD573ccd0cea792725b064f7a512e7f92ad
SHA110e8c6bb1e77f9455c1d23b21b92ed9432d0d4aa
SHA2560cf5c522398809756803be74c55c0fcabc92b0a5beb232e8b419976eea9770f3
SHA5120b5b9b8cc9523c2a8fd49b6de5e14f939b5a03aabc7b9553b77c500bf2168db289c23201766cd12bd93c9164035880d2178f4009f6d67c9055e472172ffdb8aa
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
958KB
MD5c3a038325cbfffb65baa02b02f1eb72c
SHA1430d5b577794b6732b46372361d7a7a7670a58ae
SHA2564f8ffd67641fbb7206cc5b4fdfeed8839dc7a825e28c822e9d95327be9d55d27
SHA51246871612fbd25f139269b7f65b6ae24440f480ee8d3b29525c1f58cb9a1e2b72642b931512d7f1da714415ae5949b4840a8bea217f2f7bb3c39155009dcb61ac