Analysis

  • max time kernel
    0s
  • max time network
    62s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/04/2025, 20:33

General

  • Target

    dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe

  • Size

    23.0MB

  • MD5

    07ec451b057f8b175ddb971c24d0d740

  • SHA1

    1c3a88ebce818243bf5b31e55812de3c8e0458b4

  • SHA256

    dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a

  • SHA512

    7db5cde2310fd8b7914c26edbb86cfebb55c595eec49d8596bf45488c411bed72fcf6086c7ed8c6cfd1bc4505fedf339f5cc00abeeed43928673c20f3d450c50

  • SSDEEP

    393216:Q8t/QCMfMwqfGr8vOu7deqcbOL78sJwf5tyDAn5aYKLW6S:n1QtUwJu5eNo0f5EDAn1KRS

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

Spot1511

C2

nvdiedico.knowsitall.info:3297

dico.is-a-hard-worker.com:3297

roxy.is-by.us:3297

nicholds.dyndns-web.com:3297

nvdiedicozeus.dyndns-web.com:3297

nvdieroxy.servebbs.org:3297

nvdiedicob.is-a-chef.org:3297

nerverdieorcus.is-a-doctor.com:3297

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    rmlogs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Rmxplgdatas-ORUCBL

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Extracted

Family

netwire

C2

wire.mine.nu:9702

dico.is-very-bad.org:9702

roxy.dynalias.net:9702

regiskm67.buyshouses.net:9702

zeusnodie.mypets.ws:9702

nvdiedicobies.is-a-hard-worker.com:9702

nvdieroxy.kicks-ass.net:9702

nvdiedicozeuse.webhop.org:9702

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    Spot1411

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    Entubebd

  • offline_keylogger

    true

  • password

    0000

  • registry_autorun

    false

  • use_mutex

    true

Signatures

  • NetWire RAT payload 3 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Netwire family
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe
    "C:\Users\Admin\AppData\Local\Temp\dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2168
    • C:\Users\Admin\AppData\Roaming\nb673-full.exe
      "C:\Users\Admin\AppData\Roaming\nb673-full.exe"
      2⤵
        PID:3348
      • C:\Users\Admin\AppData\Roaming\RxWindriver.exe
        "C:\Users\Admin\AppData\Roaming\RxWindriver.exe"
        2⤵
          PID:436
          • C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
            "C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat" suwbmcn.eme
            3⤵
              PID:760
              • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
                "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
                4⤵
                  PID:3080
            • C:\Users\Admin\AppData\Roaming\Netframework.exe
              "C:\Users\Admin\AppData\Roaming\Netframework.exe"
              2⤵
                PID:3464
                • C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd
                  "C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd" sktfl.wts
                  3⤵
                    PID:3972
                    • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
                      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
                      4⤵
                        PID:1984
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\97028583\WQMVJK~1.BAT C:\Users\Admin\AppData\Local\Temp\97028583\suwbmcn.eme
                  1⤵
                    PID:3712
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\02611875\DHIDHB~1.CMD C:\Users\Admin\AppData\Local\Temp\02611875\sktfl.wts
                    1⤵
                      PID:4312

                    Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\02611875\jalabegr.txt

                      Filesize

                      269KB

                      MD5

                      6f3aa0896874ab108c07673ff22978bd

                      SHA1

                      787c20c688a551560c1119581da7bcc1aa754dad

                      SHA256

                      8f3c8402a49c242cad6162f1c4f178cd7d2c7aa23bb34fea473144f2e3c438af

                      SHA512

                      28e403c1373c8c282ed57a034b25a258503caf669669aaf7bd869db340be8120f910724c79ceb8a0f010a9d58cb4000e4cd932b223df69c3b7bef3194bceea34

                    • C:\Users\Admin\AppData\Local\Temp\97028583\nrveb.msc

                      Filesize

                      308KB

                      MD5

                      8296a539bec586333a216bca6dba8bbd

                      SHA1

                      696098c5bde90f2fda807dd7b42a744ee55965a7

                      SHA256

                      aa05bf9b4485d0cc21eb8881828136cca038ce7676bd1aa0e3df2bd60e80efc1

                      SHA512

                      c31cc0466f549e42672fe4d5aa9c8a24383210a6db1e4d141678170666711b3b9dec3d9400e7c18c8e2c5710ca7d2c859597ccefd04d8b2fecd44424428585e4

                    • C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat

                      Filesize

                      732KB

                      MD5

                      71d8f6d5dc35517275bc38ebcc815f9f

                      SHA1

                      cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

                      SHA256

                      fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

                      SHA512

                      4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

                    • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

                      Filesize

                      45KB

                      MD5

                      96c201253a2a277d7e6d40167548991a

                      SHA1

                      f3b0e69f65e9a27a5af1d96af75f1a6a23cf77aa

                      SHA256

                      808aec47f908410c01f820683f1c33198e05525d159863925690fdeb319eac1a

                      SHA512

                      8c2af8688802019fd0c18fcd279ac3821caa0923631610589a6c23663d5200038ad7e3cfe698339ee92cf621ef4ffedf11bc5082cb6ed860eb955dfc60fdacc4

                    • C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\InstallOptions.dll

                      Filesize

                      14KB

                      MD5

                      3e277798b9d8f48806fbb5ebfd4990db

                      SHA1

                      d1ab343c5792bc99599ec7acba506e8ba7e05969

                      SHA256

                      fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c

                      SHA512

                      84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92

                    • C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\LangDLL.dll

                      Filesize

                      5KB

                      MD5

                      b26b412d9f1050ad53f663c972fdcd9f

                      SHA1

                      7bc4ed444f3f8fd14c2c36784d828175bace8c17

                      SHA256

                      70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a

                      SHA512

                      ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46

                    • C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\System.dll

                      Filesize

                      11KB

                      MD5

                      3f176d1ee13b0d7d6bd92e1c7a0b9bae

                      SHA1

                      fe582246792774c2c9dd15639ffa0aca90d6fd0b

                      SHA256

                      fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

                      SHA512

                      0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

                    • C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\UAC.dll

                      Filesize

                      14KB

                      MD5

                      4814167aa1c7ec892e84907094646faa

                      SHA1

                      a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee

                      SHA256

                      32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822

                      SHA512

                      fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067

                    • C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\UserInfo.dll

                      Filesize

                      4KB

                      MD5

                      c22c9d7b6937b8960fba4c8a145076b2

                      SHA1

                      2e45c2dd6e5132a942fe940dccdaf771e0f9e81e

                      SHA256

                      510e466a715933499fb9d5a1753b483826b2bf89161b9d466dd2ad7e52ede2fc

                      SHA512

                      b3b93fb97bc0d16ac35a1f0e877bcf42324e19d21839b025329d1b27d8e96bc9c0cbde0a8d60b23fd0c864f62e3c287461108c6abecf53ac488de1fc16b47d6e

                    • C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\cpudesc.dll

                      Filesize

                      4KB

                      MD5

                      d25102051b33f61c9f7fb564a4556219

                      SHA1

                      c683964c11d5175171bd009cb08f87592c923f85

                      SHA256

                      e58e5d1d8da2ea526d0d754b4faad3773021166b0720723efb7b30f1f5075398

                      SHA512

                      8828eec31926251d7e51b5bf1050c3519c9b7fca4f978fb6ee0bf18f9642c3460687f10ff79e5892100ecadbf49725711567c348e1dfccb3644bd9ef992a92f0

                    • C:\Users\Admin\AppData\Local\Temp\nsz2CE.tmp\nsDialogs.dll

                      Filesize

                      9KB

                      MD5

                      b3070cf20db659fdfb3cb2ed38130e8d

                      SHA1

                      aa234b0620bebddde1414ff6b0840d883890b413

                      SHA256

                      f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0

                      SHA512

                      4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1

                    • C:\Users\Admin\AppData\Roaming\Netframework.exe

                      Filesize

                      1.4MB

                      MD5

                      6b60dfc1c2ff57eb2a32423995c766e8

                      SHA1

                      adcd8abb899c4e009216384dcf1f54ed5ba52819

                      SHA256

                      b21f28cf27f33b0ef78a2b1a5040f48fe8a13e5553ee870b1a77d8aefc7aa81b

                      SHA512

                      7d303c9eb3953173694ac6a87aa5dc4eeb1a21ed480a48e776dfbec5822468bcec84ccece786ab7a3483a3e4e4824462444535d23bf23e42cf67bd4a5707cb0b

                    • C:\Users\Admin\AppData\Roaming\RxWindriver.exe

                      Filesize

                      1.4MB

                      MD5

                      d323f3245223177b63de1ecbe3f47663

                      SHA1

                      ed7c2f0a5bd951b946a471cc7d5771ce6a5f61dc

                      SHA256

                      f82e132f601da9270a40d268809974af7aa406a75e2fa63075a9c3fa3e35673c

                      SHA512

                      c3b7a7e6b0b95e3ef3cc9766430596d812ce5844ed45c0ad016b6998aa4e7e71602cf2f4b16100aac4406bef2255f5c88354b87cc3cfbfbace50b06974ec9d79

                    • C:\Users\Admin\AppData\Roaming\nb673-full.exe

                      Filesize

                      8.6MB

                      MD5

                      a8a84f7f02f7cf9b3db6910de537b186

                      SHA1

                      33ef8c6f2c2a107938652986feb3e870df87b678

                      SHA256

                      b2f4635408cde1bbf892074a1d3fe01d9f1141925b3f1bdea8c494084e696826

                      SHA512

                      4526bf720a035bafc4a6f6b123efa3d82c997052fc5adf5ad17351ad47dc2ec5040c64f894d5b114d78a4ab9e42989d3fc7187c0ce4c73640461ca28f634302d

                    • C:\Users\Admin\AppData\Roaming\nb673-full.exe

                      Filesize

                      9.6MB

                      MD5

                      e70213bdd7fba84b47a0fb7536411160

                      SHA1

                      b7c86bd575d3c16a0b549165945c223a2007cbe5

                      SHA256

                      03b62040f94df47d33ca7d77e55c175d6402a3bf9ba5c9b52d2763da9ef1fda4

                      SHA512

                      f4981731b19a02802b2c8c3663c20852bbd2420af56accac7fbfba70136ec9ec8034cfdf85550b5686b3729bc7199fd90090989cf24eb77929085641536af892

                    • C:\Users\Admin\AppData\Roaming\nb673-full.exe

                      Filesize

                      8.9MB

                      MD5

                      7216859ade4b53dd0e0ac198dc77ad90

                      SHA1

                      1eaa7c4ac6db22a243ffbbf427239bf2b49983d7

                      SHA256

                      b080ec36636322a2fb71b5c7aabcea776ea16d989ff6d5ffe56e3547b1a770c2

                      SHA512

                      4079bba09ca0f3a128630a1e73b7d546d2a344bd2a96518847f8d947e2ecf08cddfdd24fa9bc2d6819eaa4282a0f9e92b70ec457c8abe720673d03d50008a354

                    • memory/1984-331-0x0000000000900000-0x0000000001900000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/1984-333-0x0000000000900000-0x0000000001900000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/1984-335-0x0000000000900000-0x0000000001900000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/3080-326-0x0000000000F00000-0x0000000001F00000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/3080-322-0x0000000000F00000-0x0000000001F00000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/3080-324-0x0000000000F00000-0x0000000001F00000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/3080-329-0x0000000000F00000-0x0000000001F00000-memory.dmp

                      Filesize

                      16.0MB

                    • memory/3080-330-0x0000000000F00000-0x0000000001F00000-memory.dmp

                      Filesize

                      16.0MB