Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2025, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
CUSTOMER DATA.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
CUSTOMER DATA.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
Udmarchen/specklessness.doc
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Udmarchen/specklessness.doc
Resource
win10v2004-20250217-en
General
-
Target
CUSTOMER DATA.exe
-
Size
682KB
-
MD5
1ee896eb5062be71b5a64050b1475a48
-
SHA1
fc46f638209638e388fd78e3296f5f1700fc010f
-
SHA256
0c401d88ca37c0f3082c17b31112b79a9bbc08224e9566e9daf130ed07f25e15
-
SHA512
c5d2fc305424b5532400df7ff9f424f273f38f2ca91ac145ff239510ced1143c58bc780b0bc28a9d9208c664a4ed6e006041d0d45cd53170fc1661f3719c002f
-
SSDEEP
12288:wYFMrtB0O4iiEGBXymOKhzqaVuJkw7UGP4ZX9sF+NtgOLISfsAQTw:wYytB0O4i4/OKh2VJN4W8XkcWOLZfsAf
Malware Config
Extracted
remcos
RemoteHost
204.10.161.144:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2BC44O
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Remcos family
-
Detected Nirsoft tools 8 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/1300-47-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/1556-54-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/1556-53-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2416-46-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/1300-44-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/2416-43-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/1556-56-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2416-59-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/1300-47-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/1300-44-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2416-46-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/2416-43-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/2416-59-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Loads dropped DLL 1 IoCs
pid Process 592 CUSTOMER DATA.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts CUSTOMER DATA.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4684 CUSTOMER DATA.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 592 CUSTOMER DATA.exe 4684 CUSTOMER DATA.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4684 set thread context of 2416 4684 CUSTOMER DATA.exe 94 PID 4684 set thread context of 1300 4684 CUSTOMER DATA.exe 95 PID 4684 set thread context of 1556 4684 CUSTOMER DATA.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUSTOMER DATA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUSTOMER DATA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUSTOMER DATA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUSTOMER DATA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUSTOMER DATA.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2416 CUSTOMER DATA.exe 2416 CUSTOMER DATA.exe 1556 CUSTOMER DATA.exe 1556 CUSTOMER DATA.exe 2416 CUSTOMER DATA.exe 2416 CUSTOMER DATA.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 592 CUSTOMER DATA.exe 4684 CUSTOMER DATA.exe 4684 CUSTOMER DATA.exe 4684 CUSTOMER DATA.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1556 CUSTOMER DATA.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4684 CUSTOMER DATA.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 592 wrote to memory of 4684 592 CUSTOMER DATA.exe 90 PID 592 wrote to memory of 4684 592 CUSTOMER DATA.exe 90 PID 592 wrote to memory of 4684 592 CUSTOMER DATA.exe 90 PID 592 wrote to memory of 4684 592 CUSTOMER DATA.exe 90 PID 4684 wrote to memory of 2416 4684 CUSTOMER DATA.exe 94 PID 4684 wrote to memory of 2416 4684 CUSTOMER DATA.exe 94 PID 4684 wrote to memory of 2416 4684 CUSTOMER DATA.exe 94 PID 4684 wrote to memory of 1300 4684 CUSTOMER DATA.exe 95 PID 4684 wrote to memory of 1300 4684 CUSTOMER DATA.exe 95 PID 4684 wrote to memory of 1300 4684 CUSTOMER DATA.exe 95 PID 4684 wrote to memory of 1556 4684 CUSTOMER DATA.exe 96 PID 4684 wrote to memory of 1556 4684 CUSTOMER DATA.exe 96 PID 4684 wrote to memory of 1556 4684 CUSTOMER DATA.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe"C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe"C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe"C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wpdcc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe"C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zjquuxlb"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:1300
-
-
C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe"C:\Users\Admin\AppData\Local\Temp\CUSTOMER DATA.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jdwnvpwdjdp"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5256a349b3d637e8fdcda657efbb1d8fc
SHA19eb39177b8c3eff919104dd9f3f2a6fca076d50c
SHA2569fb4e07b48a19bab6c0010abe0db270c8c7ac8420d5b579826abb2c66d5dd287
SHA512b3a1c4b97905794a054e390da16e6a326f5dc8a268ee08ca5c9df39095b25f949cc8bc651e5305a394aa56cab666ab0971351b7947e7b6e4623a528cc48baafa
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
Filesize
4KB
MD53dc6ac554259a12fbb27519148784087
SHA15254fbc3808a80deae0deef46bf35577b21d90cc
SHA2560d313e61d7ae3255d8ee25700157af18c65b6393ab2daee12f4907fd275b2910
SHA5125a394f05fce199518fc0b2370e2270254004a8818b2f3bfc47a736b83347080c5d2da8dbbee22c1d114886348546c02d8cff8b030fecfca7e1c46948ccc6b8ba