Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
18-02-2025 03:19
General
-
Target
AE09579G0033855AEDXBFFHHHHJ-VC.exe
-
Size
725KB
-
MD5
6a8043f977b84ab39909b260cbad90d3
-
SHA1
a635e93bc25b3c5138bef52ac9f163638f9c015d
-
SHA256
38321cf0a7c19a1f0a143631332b06bc6dad5b753416b50a7d3328cfa3d14224
-
SHA512
3f88ad7f79a927ada664daefa6e7413ca3910a5cf9584bd961759e1f1cbc07380f318b1e6d2f70b9332a96eda25e532b046bd75c96ae9843a5297c6ac8e4e6a4
-
SSDEEP
12288:fJIbMYmn5o9n8yNAj0Vg+r9dCOSHDBfYTMNKH1HzFJs:fJYmg9NAgVxr9dCOSHdt6jO
Malware Config
Extracted
remcos
RemoteHost
198.135.51.176:49950
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ALVH88
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Detected Nirsoft tools 6 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exe"C:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exe"C:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exeC:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exe /stext "C:\Users\Admin\AppData\Local\Temp\orldsbgxzakwnvroamdtalr"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exeC:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exe /stext "C:\Users\Admin\AppData\Local\Temp\zlqnsurrnicjpbgsjwqvdylaeep"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exeC:\Users\Admin\AppData\Local\Temp\AE09579G0033855AEDXBFFHHHHJ-VC.exe /stext "C:\Users\Admin\AppData\Local\Temp\jnvgtmksbquoapcwshcwocyjnshpgz"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5d85a3bec8b3275fa0bdde714ddb9aa33
SHA17aa19bea661aef11e67d69621dd3a1d304fe15ca
SHA2566e99cc53e5fdba19a75685938fddf477ec0884fb6dbf245414819296a682ec67
SHA51227189451191e8f85e7ff319635a41072b4dc88c4055280ef403083b48e7a824fc842e5d3a25e2c5f446c3b7009ff98bf786a0e8430818eb2c373780dd9b71805
-
Filesize
725KB
MD56a8043f977b84ab39909b260cbad90d3
SHA1a635e93bc25b3c5138bef52ac9f163638f9c015d
SHA25638321cf0a7c19a1f0a143631332b06bc6dad5b753416b50a7d3328cfa3d14224
SHA5123f88ad7f79a927ada664daefa6e7413ca3910a5cf9584bd961759e1f1cbc07380f318b1e6d2f70b9332a96eda25e532b046bd75c96ae9843a5297c6ac8e4e6a4
-
Filesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
Filesize
4KB
MD5a10a7880fd891af53a748b804855901d
SHA1c94a0f84df3e6c0a74eaafa85c43462bcbf3daf2
SHA2563e77496a6009fe4dc09f9f876d43ef533893f3e3ab19bd14ed7532af4ac35fb5
SHA512c71759e33b746eb7cd08663abf20cc707c29943c00a01b627110919f901c6de9fdb3d15c4ece81d5f5c2969593fda1c1f403dca26915f52c3de9d97444627fbf
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
44.6MB
-
Filesize
44.6MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
44.6MB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
44.6MB
-
Filesize
44.6MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
44.6MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB