Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20250217-en - resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system - submitted
18/02/2025, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
d.msi
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
d.msi
Resource
win11-20250217-en
windows11-21h2-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
d.msi
Resource
win7-20241010-en
windows7-x64
21 signatures
150 seconds
General
- Target d.msi
- Size 2.9MB
- Sample250218-rawlyssnx2
- SHA256 f286d2b89eaebb2e1e6e23a44bc92dae7c058348286810549f4c7514c9ea61ad
- MD5 ae5b94abf028388af1454ed76806cc6f
- SHA1 ef013c7eec6fc6c14ccd414b5eb87abf1476566a
- SHA512 b88c3c160b68b0bdc03780a6848001aef7baa5532b815071eb4f26ff1caa87f71b2401b0c507db5389d14517310bae758aaa17f6fe7aa508f2de38cdbcac1fe2
- SSDEEP 49152:TL51ahTWxFOlm43he+4Xkt1i1XkIZ9fm5urK7olHgnIxQQ6brit:p8h8ME4xr461ckZPoxgnsSa
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
remcos
Botnet
-
v2
C2
-
185.157.162.126:1995
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
qsdazeazd-EL00KX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/files/0x001900000002adfd-31.dat family_hijackloader - HijackLoader
HijackLoader is a multistage loader first seen in 2023.
- Hijackloader family
- Remcos family
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1408376509-1621642251-2666462513-1000\Software\Microsoft\Windows\CurrentVersion\Run\EHttpSrv = "\"C:\\Users\\Admin\\AppData\\Roaming\\IXXinstall\\EHttpSrv.exe\"" msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2300 set thread context of 4244 2300 EHttpSrv.exe 88 PID 4244 set thread context of 4872 4244 cmd.exe 91 - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF3A381C320445BD43.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF76BB722956B3B278.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFBD8199760F06653E.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B1C5FCCC-2DDA-41F7-8B6A-192BB64891A0} msiexec.exe File created C:\Windows\SystemTemp\~DF372D54AB87CE0E78.TMP msiexec.exe File created C:\Windows\Installer\e57ac7c.msi msiexec.exe File opened for modification C:\Windows\Installer\e57ac7c.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIAD38.tmp msiexec.exe File created C:\Windows\Installer\e57ac7e.msi msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 2300 EHttpSrv.exe - Loads dropped DLL 3 IoCs
pid Process 2300 EHttpSrv.exe 2300 EHttpSrv.exe 4872 EHttpSrv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 736 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 852 msiexec.exe 852 msiexec.exe 2300 EHttpSrv.exe 4244 cmd.exe 4244 cmd.exe - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2300 EHttpSrv.exe 4244 cmd.exe 4244 cmd.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 736 msiexec.exe Token: SeIncreaseQuotaPrivilege 736 msiexec.exe Token: SeSecurityPrivilege 852 msiexec.exe Token: SeCreateTokenPrivilege 736 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 736 msiexec.exe Token: SeLockMemoryPrivilege 736 msiexec.exe Token: SeIncreaseQuotaPrivilege 736 msiexec.exe Token: SeMachineAccountPrivilege 736 msiexec.exe Token: SeTcbPrivilege 736 msiexec.exe Token: SeSecurityPrivilege 736 msiexec.exe Token: SeTakeOwnershipPrivilege 736 msiexec.exe Token: SeLoadDriverPrivilege 736 msiexec.exe Token: SeSystemProfilePrivilege 736 msiexec.exe Token: SeSystemtimePrivilege 736 msiexec.exe Token: SeProfSingleProcessPrivilege 736 msiexec.exe Token: SeIncBasePriorityPrivilege 736 msiexec.exe Token: SeCreatePagefilePrivilege 736 msiexec.exe Token: SeCreatePermanentPrivilege 736 msiexec.exe Token: SeBackupPrivilege 736 msiexec.exe Token: SeRestorePrivilege 736 msiexec.exe Token: SeShutdownPrivilege 736 msiexec.exe Token: SeDebugPrivilege 736 msiexec.exe Token: SeAuditPrivilege 736 msiexec.exe Token: SeSystemEnvironmentPrivilege 736 msiexec.exe Token: SeChangeNotifyPrivilege 736 msiexec.exe Token: SeRemoteShutdownPrivilege 736 msiexec.exe Token: SeUndockPrivilege 736 msiexec.exe Token: SeSyncAgentPrivilege 736 msiexec.exe Token: SeEnableDelegationPrivilege 736 msiexec.exe Token: SeManageVolumePrivilege 736 msiexec.exe Token: SeImpersonatePrivilege 736 msiexec.exe Token: SeCreateGlobalPrivilege 736 msiexec.exe Token: SeBackupPrivilege 540 vssvc.exe Token: SeRestorePrivilege 540 vssvc.exe Token: SeAuditPrivilege 540 vssvc.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 736 msiexec.exe 736 msiexec.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 852 wrote to memory of 2300 852 msiexec.exe 87 PID 852 wrote to memory of 2300 852 msiexec.exe 87 PID 852 wrote to memory of 2300 852 msiexec.exe 87 PID 2300 wrote to memory of 4244 2300 EHttpSrv.exe 88 PID 2300 wrote to memory of 4244 2300 EHttpSrv.exe 88 PID 2300 wrote to memory of 4244 2300 EHttpSrv.exe 88 PID 2300 wrote to memory of 4244 2300 EHttpSrv.exe 88 PID 4244 wrote to memory of 4872 4244 cmd.exe 91 PID 4244 wrote to memory of 4872 4244 cmd.exe 91 PID 4244 wrote to memory of 4872 4244 cmd.exe 91 PID 4244 wrote to memory of 4872 4244 cmd.exe 91 PID 4244 wrote to memory of 4872 4244 cmd.exe 91 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:736
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe"C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exeC:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4872
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:540
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57ac7d.rbs
- Size 10KB
- SHA256 7a4f895aa89f2d4228359caa838f0d83d940c4860844033770483fd56c8a1a0d
- MD5 c645449ae4a51995052eabe2841af6de
- SHA1 740003299eed44fb4a16e4f5f04ad07c2c9664d9
- SHA512 c1742c4563e05fa8ab98ffebb02345b1b83a9cacee66bd57fcbe48db77e48ca8e7588189b9c2e341fd423dee4038338479b38649666f74387769574543a20af1
- SSDEEP 192:DEzytd9dN9JfNsyCQODjpGOIZDDjpGOZZ3K5Lpd:DEzytd9dN9tNs1DjpGfDDjpGC3KR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\eb7ecbbb
- Size 1.0MB
- SHA256 48219d60c27ffdca735607df63741cc0d090fe762e74638980dc7fae492efcd2
- MD5 a27d9fbb0933de0176a1ab96be1b3869
- SHA1 46403370752cb1660c0b7fee36fbb420431988cc
- SHA512 86263340a29addac62e3a8ba1777340594bbf4f10a19a84170dc5d09eae244e150b274109706954d9615daea6811fe1dfbcad71a9aa032049e0040986a563644
- SSDEEP 24576:HLO6cA/1VhuPs6KoYMh+KXXXnXXAk7ef/Xq7UzGhMV6NxduXk8IU:H7cm6JDXXnXXAk6/XnZV6NDgp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe
- Size 20KB
- SHA256 effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659
- MD5 9329ba45c8b97485926a171e34c2abb8
- SHA1 20118bc0432b4e8b3660a4b038b20ca28f721e5c
- SHA512 0af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc
- SSDEEP 384:Damtvzlx5v02RIDauMTnxOn6sGCYJLW7wycJbi6jc:D7Jv0qpukxO6s6Lhbimc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\IXXinstall\MFC80U.DLL
- Size 1.0MB
- SHA256 a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36
- MD5 686b224b4987c22b153fbb545fee9657
- SHA1 684ee9f018fbb0bbf6ffa590f3782ba49d5d096c
- SHA512 44d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875
- SSDEEP 12288:wsaHmJ//R12t2PdMvWxMIQ1zoKyK0ivyHCJKjswl/KY6oQy3AmgVk2YDFpR7m81H:KHmJ+tKtxMIQNmCcjswl/KYh/2YFnb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\IXXinstall\audiogram.tif
- Size 877KB
- SHA256 ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6
- MD5 5124236fd955464317fbb1f344a1d2f2
- SHA1 fe3a91e252f1dc3c3b4980ade7157369ea6f5097
- SHA512 2b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252
- SSDEEP 24576:huxSUG0FCq7vlCaw416/GCvEowni/F9jXR54:MRJFCq7vl6zdj2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\IXXinstall\http_dll.dll
- Size 1.9MB
- SHA256 b0d665cb466e10ef90e1d79a39cb655ebe785d0cefc074f7a22d04936b681879
- MD5 fe47e255c704b20cb20c8ed93ec94d47
- SHA1 ed7d26624b3cfaa72cf7d3bc59d26845fb84247a
- SHA512 55813a4b755773f98991b47294fed03b23d5bee9af3ef98727b7345882fe0d9976546f46847fbc30119e7c62ce7ee8ae21f54065922041cf8d42364e607bc1c0
- SSDEEP 49152:TxG3VWOYnHJVGbzOaufeY7ENBZBWAwPJ7YrVKG:rYO/feY7E3/kdK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e57ac7c.msi
- Size 2.9MB
- SHA256 f286d2b89eaebb2e1e6e23a44bc92dae7c058348286810549f4c7514c9ea61ad
- MD5 ae5b94abf028388af1454ed76806cc6f
- SHA1 ef013c7eec6fc6c14ccd414b5eb87abf1476566a
- SHA512 b88c3c160b68b0bdc03780a6848001aef7baa5532b815071eb4f26ff1caa87f71b2401b0c507db5389d14517310bae758aaa17f6fe7aa508f2de38cdbcac1fe2
- SSDEEP 49152:TL51ahTWxFOlm43he+4Xkt1i1XkIZ9fm5urK7olHgnIxQQ6brit:p8h8ME4xr461ckZPoxgnsSa
- MD5 SHA1 SHA512 SSDEEP