e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b

Resubmissions

19/08/2025, 10:45

250819-mtlhwaspw210

18/08/2025, 15:53

250818-tbr19svqs610

18/08/2025, 15:45

250818-s67vjaak3x10

09/07/2025, 23:50

250709-3vxwastnv210

Analysis

max time kernel
898s
max time network
900s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
19/08/2025, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b.exe
Size 601KB
Sample250819-mtlhwaspw2
SHA256 e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b
MD5 d9862812455c4a0f7d07bf14e14db17c
SHA1 d0dd5a73cec6d80a32cbc90d4bac364eda45a6fb
SHA512 a9ea6fd272ffc805f9ed8f852d1404789855d76632615abd7320b910fc484fdb7c4b45193367cc55621cadae17252bbabb765f09f5a52dbabcf056ad9cddec6b
SSDEEP 12288:cmmEXhe7R9ubKYcX1knn4gzHoS6oQ5Mt6w/j:c/ERWR9ubKYdnn4gzoS6t5I
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4644	explore.exe
968	explore.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-52CQ0B = "\"C:\\ProgramData\\local\\explore.exe\""	e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-52CQ0B = "\"C:\\ProgramData\\local\\explore.exe\""	e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-52CQ0B = "\"C:\\ProgramData\\local\\explore.exe\""	explore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-52CQ0B = "\"C:\\ProgramData\\local\\explore.exe\""	explore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4644	explore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 4644	5280	e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b.exe	80
PID 5280 wrote to memory of 4644	5280	e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b.exe	80
PID 2180 wrote to memory of 968	2180	cmd.exe	81
PID 2180 wrote to memory of 968	2180	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b.exe
"C:\Users\Admin\AppData\Local\Temp\e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5280
- C:\ProgramData\local\explore.exe
  "C:\ProgramData\local\explore.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:4644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\local\explore.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\ProgramData\local\explore.exe
  C:\ProgramData\local\explore.exe
  2⤵
  - Executes dropped EXE
  PID:968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explore.exe

Path C:\ProgramData\local\explore.exe
Size 601KB
SHA256 e24d9afbc2ed01e348ef6946672ef5f310940dd57a5216d0f1edbe31c919374b
MD5 d9862812455c4a0f7d07bf14e14db17c
SHA1 d0dd5a73cec6d80a32cbc90d4bac364eda45a6fb
SHA512 a9ea6fd272ffc805f9ed8f852d1404789855d76632615abd7320b910fc484fdb7c4b45193367cc55621cadae17252bbabb765f09f5a52dbabcf056ad9cddec6b
SSDEEP 12288:cmmEXhe7R9ubKYcX1knn4gzHoS6oQ5Mt6w/j:c/ERWR9ubKYdnn4gzoS6t5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 8e18f9393e4a2f5c8339c88c2b6eaed6e7a8f44db2a40c8ad83fecdbbfbf8072
MD5 d39bcd68e19ce19093f0785c75aa340b
SHA1 880d85fcbaae5538fd6991c8982ff94c060a159b
SHA512 4f1821e76fd7a3716af0f79583563c53fbf3b0ca064d3f677a960e84b8ed4c80d92709ba0725a257a3fe97f4872d914568659bbc05c2b554000b6aa567c5c78b
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads