Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/07/2026, 18:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dev.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
dev.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target dev.msi
- Size 1.5MB
- Sample260710-wx2hyaew6m
- SHA256 0c990d0491b82bf715373a50a2cd66db219c309bf1937d3147b0246e217e722c
- MD5 2171c21e0abae089031089fc8911db1e
- SHA1 c167dc2d558076251cecc0d0838f7a738661343a
- SHA512 a3f1f6684c1f69f5654b777b95d40abe814c9e61fe5deaf371138d7822b9028035cca90756f4dce0d6a43a4e101dc61f38e2a76c065e9fba8aeb4f64c792f007
- SSDEEP 24576:EWfx/N5WSuPgAc8rGxYwX5mCmR+GuDTIINMhZe6vr8hCmYe49Z:EWDn8r6F5mCmR+Gu4WMjecrU9s
- TLSH T11175AD15B3C38622C55D027BF459FE1E5438FE63073491E7BAF5399F48B08C1A2BAA52
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
remcos
Version
-
7.0.4 Pro
C2
-
185.157.162.230:2404
Signatures
- Loads dropped DLL 5 IoCs
pid Process 1960 MsiExec.exe 1960 MsiExec.exe 1960 MsiExec.exe 1960 MsiExec.exe 1960 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1960 set thread context of 4344 1960 MsiExec.exe 89 - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI318B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3257.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3314.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{10F3E2E5-15D5-4872-A9AF-235EA3EC6C4B} msiexec.exe File opened for modification C:\Windows\Installer\MSI33B1.tmp msiexec.exe File created C:\Windows\Installer\e5830fe.msi msiexec.exe File opened for modification C:\Windows\Installer\e5830fe.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI32E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4732 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1848 msiexec.exe 1848 msiexec.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 4732 msiexec.exe Token: SeIncreaseQuotaPrivilege 4732 msiexec.exe Token: SeSecurityPrivilege 1848 msiexec.exe Token: SeCreateTokenPrivilege 4732 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4732 msiexec.exe Token: SeLockMemoryPrivilege 4732 msiexec.exe Token: SeIncreaseQuotaPrivilege 4732 msiexec.exe Token: SeMachineAccountPrivilege 4732 msiexec.exe Token: SeTcbPrivilege 4732 msiexec.exe Token: SeSecurityPrivilege 4732 msiexec.exe Token: SeTakeOwnershipPrivilege 4732 msiexec.exe Token: SeLoadDriverPrivilege 4732 msiexec.exe Token: SeSystemProfilePrivilege 4732 msiexec.exe Token: SeSystemtimePrivilege 4732 msiexec.exe Token: SeProfSingleProcessPrivilege 4732 msiexec.exe Token: SeIncBasePriorityPrivilege 4732 msiexec.exe Token: SeCreatePagefilePrivilege 4732 msiexec.exe Token: SeCreatePermanentPrivilege 4732 msiexec.exe Token: SeBackupPrivilege 4732 msiexec.exe Token: SeRestorePrivilege 4732 msiexec.exe Token: SeShutdownPrivilege 4732 msiexec.exe Token: SeDebugPrivilege 4732 msiexec.exe Token: SeAuditPrivilege 4732 msiexec.exe Token: SeSystemEnvironmentPrivilege 4732 msiexec.exe Token: SeChangeNotifyPrivilege 4732 msiexec.exe Token: SeRemoteShutdownPrivilege 4732 msiexec.exe Token: SeUndockPrivilege 4732 msiexec.exe Token: SeSyncAgentPrivilege 4732 msiexec.exe Token: SeEnableDelegationPrivilege 4732 msiexec.exe Token: SeManageVolumePrivilege 4732 msiexec.exe Token: SeImpersonatePrivilege 4732 msiexec.exe Token: SeCreateGlobalPrivilege 4732 msiexec.exe Token: SeRestorePrivilege 1848 msiexec.exe Token: SeTakeOwnershipPrivilege 1848 msiexec.exe Token: SeRestorePrivilege 1848 msiexec.exe Token: SeTakeOwnershipPrivilege 1848 msiexec.exe Token: SeRestorePrivilege 1848 msiexec.exe Token: SeTakeOwnershipPrivilege 1848 msiexec.exe Token: SeRestorePrivilege 1848 msiexec.exe Token: SeTakeOwnershipPrivilege 1848 msiexec.exe Token: SeRestorePrivilege 1848 msiexec.exe Token: SeTakeOwnershipPrivilege 1848 msiexec.exe Token: SeRestorePrivilege 1848 msiexec.exe Token: SeTakeOwnershipPrivilege 1848 msiexec.exe Token: SeRestorePrivilege 1848 msiexec.exe Token: SeTakeOwnershipPrivilege 1848 msiexec.exe Token: SeRestorePrivilege 1848 msiexec.exe Token: SeTakeOwnershipPrivilege 1848 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4732 msiexec.exe 4732 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1960 1848 msiexec.exe 87 PID 1960 wrote to memory of 4344 1960 MsiExec.exe 89 PID 1960 wrote to memory of 4344 1960 MsiExec.exe 89
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\dev.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4732
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 92E9893DC32EDF0D720AAFE5B4B32DA82⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\System32\WerFault.exe"3⤵PID:4344
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- System Location Discovery: System Language Discovery
PID:3888
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e583101.rbs
- Size 1KB
- SHA256 16d278a3956fc5aad57e9c89f575cf63e72d017863c023765afff932c17f12f8
- MD5 a792705df6206ce1e6551cb48acc0a49
- SHA1 14e2533fbf11c1b5317302bcb4e6c1d61d4dcda6
- SHA512 f64d7f69a940e38631e46ee4c332a4920d38089e44cf62d93a2c285b16ffd456bcfd28347900239439aae3adb86724467490939bc7b26dc49f8513dd6122fee2
- TLSH T1D131F006C3C5A2C9FEC2CAB34772A67D55777E529D34E12CDB09804C6970B8CED69362
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\LeZeus_gamingx64\LeZeus_gamingx64.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI82e5e.LOG
- Size 20KB
- SHA256 ceaa77f8353efdac1d92546cb91841606f5ad26e7d976b1e5cf81ec9cec4c81e
- MD5 3812ea369eb6ec4b79cb7f1b1f5e536d
- SHA1 9552ed958a41742f487079bfa6cc55128bd1e266
- SHA512 2d4bb90527a95ad578bf12c7f53c8b8265dc2809538ab3e2a3f61ab7cf56f65a02f0aaec6d041632772d3123975acaf21dca594409bc0caf804d81ecd11e66f5
- SSDEEP 384:RX9bij1LGWrPZ30KdqXErvDu8arbvk2WMED04S:+nrx3vqXErvDWfvSD04S
- TLSH T1B092E37F2FF41106B2F7E6A79EF358614A32F9295931C94D21D083590872D05BABC3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Germys\dermys\revery\zlib1.dll
- Size 585KB
- SHA256 aac94c42b3f06c578e4a0ab71880e242f0b74e6f403d6938966b785e3cfd7b57
- MD5 e5b2605a95d1aa4ce7cdc26bec092a9f
- SHA1 1e219f6fef85704a64b764aada78c2d1c1630c00
- SHA512 00b2d6dc3172ad0e81095310eb385f710e94d2ffc7c56501aec46bbb3bb710baeee3a6e6449e93ae1287c7ca5316d2c3f0706975e26bcb69cb337c220aca8248
- SSDEEP 12288:UM9O5geNjBclTNAad6hPV4PYdKFXpSa3Omg761YrUhCGadefjfFZ:SBclT1d68FXpSaemYrUhCGYeL9Z
- TLSH T142D40285FBC725F3DA330A7744D7523E5978B2022612FDABEB4D27163472712BA482D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI318B.tmp
- Size 557KB
- SHA256 ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550
- MD5 2c9c51ac508570303c6d46c0571ea3a1
- SHA1 e3e0fe08fa11a43c8bca533f212bdf0704c726d5
- SHA512 df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127
- SSDEEP 6144:j+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOJVafv5khoJQCmR+:j+SuPgAc8+MjGCCslegDTwX5/OCmR+
- TLSH T18BC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH