Analysis
- max time kernel
55s - max time network
54s - platform
windows10-2004_x64 - resource
win10v2004-20250129-en - resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system - submitted
31/01/2025, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
dontrun.msi
Resource
win7-20241010-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
dontrun.msi
Resource
win10v2004-20250129-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target dontrun.msi
- Size 4.3MB
- Sample250131-tr1ncaspbl
- SHA256 d03d7ea5956a5d9ca6c1b1af800350b6ef400815b452f69a886f4156ba1a3ec5
- MD5 8e31046891c36ca794fb01262cd890d9
- SHA1 7f812da89f328e871290be32bdead1fc869377d6
- SHA512 95c4c8f0196a8e373913fc41eb44c70fa8abbea38324993aa42ca05be5d6229430a4e2a4671a914a4f00986b75845c247a91809aae994ff835aa56614606840d
- SSDEEP 98304:uo6S33tZCcSqsOEUalW+TTsKBqVauPWJg9tyEsM2:uQ3DCcOzUaleKB4NcOoH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
remcos
Botnet
-
v2
C2
-
185.157.162.126:1995
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
qsdazeazd-EL00KX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023c79-44.dat family_hijackloader - HijackLoader
HijackLoader is a multistage loader first seen in 2023.
- Hijackloader family
- Remcos family
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2696 set thread context of 5100 2696 EHttpSrv.exe 90 PID 5100 set thread context of 4032 5100 cmd.exe 94 - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\PackagerUpdt\Microsoft.VC80.CRT.manifest msiexec.exe File created C:\Program Files (x86)\Common Files\PackagerUpdt\Microsoft.VC80.MFC.manifest msiexec.exe File created C:\Program Files (x86)\Common Files\PackagerUpdt\Microsoft.VC80.MFCLOC.manifest msiexec.exe File created C:\Program Files (x86)\Common Files\PackagerUpdt\msvcr80.dll msiexec.exe File created C:\Program Files (x86)\Common Files\PackagerUpdt\audiogram.tif msiexec.exe File created C:\Program Files (x86)\Common Files\PackagerUpdt\EHttpSrv.exe msiexec.exe File created C:\Program Files (x86)\Common Files\PackagerUpdt\http_dll.dll msiexec.exe File created C:\Program Files (x86)\Common Files\PackagerUpdt\mfc80u.dll msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\e579664.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI97CC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI984A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI986A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9965.tmp msiexec.exe File opened for modification C:\Windows\Installer\e579664.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI96C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{507AAF69-5088-4927-93F7-0604B81FDD0D} msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 2696 EHttpSrv.exe - Loads dropped DLL 7 IoCs
pid Process 4680 MsiExec.exe 4680 MsiExec.exe 4680 MsiExec.exe 4680 MsiExec.exe 2696 EHttpSrv.exe 2696 EHttpSrv.exe 4032 EHttpSrv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1612 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3348 msiexec.exe 3348 msiexec.exe 2696 EHttpSrv.exe 5100 cmd.exe 5100 cmd.exe - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2696 EHttpSrv.exe 5100 cmd.exe 5100 cmd.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 1612 msiexec.exe Token: SeIncreaseQuotaPrivilege 1612 msiexec.exe Token: SeSecurityPrivilege 3348 msiexec.exe Token: SeCreateTokenPrivilege 1612 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1612 msiexec.exe Token: SeLockMemoryPrivilege 1612 msiexec.exe Token: SeIncreaseQuotaPrivilege 1612 msiexec.exe Token: SeMachineAccountPrivilege 1612 msiexec.exe Token: SeTcbPrivilege 1612 msiexec.exe Token: SeSecurityPrivilege 1612 msiexec.exe Token: SeTakeOwnershipPrivilege 1612 msiexec.exe Token: SeLoadDriverPrivilege 1612 msiexec.exe Token: SeSystemProfilePrivilege 1612 msiexec.exe Token: SeSystemtimePrivilege 1612 msiexec.exe Token: SeProfSingleProcessPrivilege 1612 msiexec.exe Token: SeIncBasePriorityPrivilege 1612 msiexec.exe Token: SeCreatePagefilePrivilege 1612 msiexec.exe Token: SeCreatePermanentPrivilege 1612 msiexec.exe Token: SeBackupPrivilege 1612 msiexec.exe Token: SeRestorePrivilege 1612 msiexec.exe Token: SeShutdownPrivilege 1612 msiexec.exe Token: SeDebugPrivilege 1612 msiexec.exe Token: SeAuditPrivilege 1612 msiexec.exe Token: SeSystemEnvironmentPrivilege 1612 msiexec.exe Token: SeChangeNotifyPrivilege 1612 msiexec.exe Token: SeRemoteShutdownPrivilege 1612 msiexec.exe Token: SeUndockPrivilege 1612 msiexec.exe Token: SeSyncAgentPrivilege 1612 msiexec.exe Token: SeEnableDelegationPrivilege 1612 msiexec.exe Token: SeManageVolumePrivilege 1612 msiexec.exe Token: SeImpersonatePrivilege 1612 msiexec.exe Token: SeCreateGlobalPrivilege 1612 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1612 msiexec.exe 1612 msiexec.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3348 wrote to memory of 4680 3348 msiexec.exe 88 PID 3348 wrote to memory of 4680 3348 msiexec.exe 88 PID 3348 wrote to memory of 4680 3348 msiexec.exe 88 PID 3348 wrote to memory of 2696 3348 msiexec.exe 89 PID 3348 wrote to memory of 2696 3348 msiexec.exe 89 PID 3348 wrote to memory of 2696 3348 msiexec.exe 89 PID 2696 wrote to memory of 5100 2696 EHttpSrv.exe 90 PID 2696 wrote to memory of 5100 2696 EHttpSrv.exe 90 PID 2696 wrote to memory of 5100 2696 EHttpSrv.exe 90 PID 2696 wrote to memory of 5100 2696 EHttpSrv.exe 90 PID 5100 wrote to memory of 4032 5100 cmd.exe 94 PID 5100 wrote to memory of 4032 5100 cmd.exe 94 PID 5100 wrote to memory of 4032 5100 cmd.exe 94 PID 5100 wrote to memory of 4032 5100 cmd.exe 94 PID 5100 wrote to memory of 4032 5100 cmd.exe 94
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\dontrun.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1612
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD3088FEF30D28948F56D223CFD29D372⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4680
-
-
C:\Program Files (x86)\Common Files\PackagerUpdt\EHttpSrv.exe"C:\Program Files (x86)\Common Files\PackagerUpdt\EHttpSrv.exe"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Program Files (x86)\Common Files\PackagerUpdt\EHttpSrv.exe"C:\Program Files (x86)\Common Files\PackagerUpdt\EHttpSrv.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4032
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e579667.rbs
- Size 2KB
- SHA256 ed99c261bff0ce7878818961ec8110dfc791f1093827b5867d2b981560590378
- MD5 621baf1cbce0887a15ecd843cf1783fc
- SHA1 a00c28e53f41937e4af7105dd02ad662ecdf7054
- SHA512 f01128eaa89310bdd0436f8ca2720bf6317e5f0f136718c6d883a060e881231ed4a9f94e6f63b034e0e252f90fa04514526b047d42ec462648687281b7e2bc7e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Common Files\PackagerUpdt\EHttpSrv.exe
- Size 20KB
- SHA256 effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659
- MD5 9329ba45c8b97485926a171e34c2abb8
- SHA1 20118bc0432b4e8b3660a4b038b20ca28f721e5c
- SHA512 0af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc
- SSDEEP 384:Damtvzlx5v02RIDauMTnxOn6sGCYJLW7wycJbi6jc:D7Jv0qpukxO6s6Lhbimc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Common Files\PackagerUpdt\audiogram.tif
- Size 877KB
- SHA256 ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6
- MD5 5124236fd955464317fbb1f344a1d2f2
- SHA1 fe3a91e252f1dc3c3b4980ade7157369ea6f5097
- SHA512 2b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252
- SSDEEP 24576:huxSUG0FCq7vlCaw416/GCvEowni/F9jXR54:MRJFCq7vl6zdj2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Common Files\PackagerUpdt\http_dll.dll
- Size 2.3MB
- SHA256 e296a18272a7bde471f37e51d49e6febe944ed4e78a2d5e79f1b2ee3330fb10f
- MD5 1e2a640f1a98da16fc61c865cec7d54e
- SHA1 178563fab7b06e99551f66ba090d0911205a2fe4
- SHA512 2426b1ce2bd01af6f34c56e1ef0290e521566ae1196a15aeb594bcf33793aa405ce01b4196bfe48de33320bab7a570a55110995025c54edcf790c2d10166fa9c
- SSDEEP 49152:9xGcVWO9d9mh5Y8lI1qAuiTIylpy49ML7+lM1D388ocZ:RwY6I1Rdty2K7s4DoS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Common Files\PackagerUpdt\mfc80u.dll
- Size 1.0MB
- SHA256 a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36
- MD5 686b224b4987c22b153fbb545fee9657
- SHA1 684ee9f018fbb0bbf6ffa590f3782ba49d5d096c
- SHA512 44d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875
- SSDEEP 12288:wsaHmJ//R12t2PdMvWxMIQ1zoKyK0ivyHCJKjswl/KY6oQy3AmgVk2YDFpR7m81H:KHmJ+tKtxMIQNmCcjswl/KYh/2YFnb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1eedfe07
- Size 1.0MB
- SHA256 95a96fb58d4df79a2f248dc9c4911c23d38b4b9c90d4fd842ae76d7beb1c0ddd
- MD5 98c6dd7629e23f0a8c90c2cd5a0205b9
- SHA1 9d9d757d55ac7e3ff08e37c6ff71edd74edf9700
- SHA512 861fdaf11e77a3823fa30ecb3ab1946e2e21ff76c5b78554c8837e70856aa092926972a8cf71ee2c2e69439be032656791d25198b55244c541382b704216e88d
- SSDEEP 24576:YpI553z8F7VdgtHcNCBnxh+TM2IW56VLY0l+0qOXEZVMQi0:C253zcVs+w7W56VTU0JEsd0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI794ce.LOG
- Size 20KB
- SHA256 f200912e413cfcab65233aa3e84f84a86a462969dc169f30ec1b3e0e90e2e78f
- MD5 bc6a861d9caf9298c2edce66f175779b
- SHA1 05292c3584de241b9a137d6e6a99012024e60be9
- SHA512 d343332b57909104932f97de02f8961a4264c848039447c3247162b939912dbb20a82bf428182ed3263bbb1b1d395dcd70e021c405e4f8328a52007e93839473
- SSDEEP 192:hg/PM/PAp68ivvXqWgymcLu8SrN2426bR5ib0Mg:hUA8ivvXqWEcLu8SrNYWKb0Mg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI96C2.tmp
- Size 557KB
- SHA256 ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550
- MD5 2c9c51ac508570303c6d46c0571ea3a1
- SHA1 e3e0fe08fa11a43c8bca533f212bdf0704c726d5
- SHA512 df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127
- SSDEEP 6144:j+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOJVafv5khoJQCmR+:j+SuPgAc8+MjGCCslegDTwX5/OCmR+
- MD5 SHA1 SHA512 SSDEEP