Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 18:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dev.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
dev.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target dev.msi
- Size 1.5MB
- Sample260710-wx2hyaew6m
- SHA256 0c990d0491b82bf715373a50a2cd66db219c309bf1937d3147b0246e217e722c
- MD5 2171c21e0abae089031089fc8911db1e
- SHA1 c167dc2d558076251cecc0d0838f7a738661343a
- SHA512 a3f1f6684c1f69f5654b777b95d40abe814c9e61fe5deaf371138d7822b9028035cca90756f4dce0d6a43a4e101dc61f38e2a76c065e9fba8aeb4f64c792f007
- SSDEEP 24576:EWfx/N5WSuPgAc8rGxYwX5mCmR+GuDTIINMhZe6vr8hCmYe49Z:EWDn8r6F5mCmR+Gu4WMjecrU9s
- TLSH T11175AD15B3C38622C55D027BF459FE1E5438FE63073491E7BAF5399F48B08C1A2BAA52
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
remcos
Version
-
7.0.4 Pro
C2
-
185.157.162.230:2404
Signatures
- Loads dropped DLL 5 IoCs
pid Process 3428 MsiExec.exe 3428 MsiExec.exe 3428 MsiExec.exe 3428 MsiExec.exe 3428 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3428 set thread context of 3492 3428 MsiExec.exe 89 - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI3B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI45E.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF8DAB69EC1CC881E8.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{10F3E2E5-15D5-4872-A9AF-235EA3EC6C4B} msiexec.exe File opened for modification C:\Windows\Installer\e5900c1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1CB.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0643D8BE47D7E974.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF9C15C1FD2215649B.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFBE61B0294CEEA86B.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI51B.tmp msiexec.exe File created C:\Windows\Installer\e5900c1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI314.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2132 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ DllHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ DllHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ DllHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ DllHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ DllHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ DllHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5720 msiexec.exe 5720 msiexec.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 2132 msiexec.exe Token: SeIncreaseQuotaPrivilege 2132 msiexec.exe Token: SeSecurityPrivilege 5720 msiexec.exe Token: SeCreateTokenPrivilege 2132 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2132 msiexec.exe Token: SeLockMemoryPrivilege 2132 msiexec.exe Token: SeIncreaseQuotaPrivilege 2132 msiexec.exe Token: SeMachineAccountPrivilege 2132 msiexec.exe Token: SeTcbPrivilege 2132 msiexec.exe Token: SeSecurityPrivilege 2132 msiexec.exe Token: SeTakeOwnershipPrivilege 2132 msiexec.exe Token: SeLoadDriverPrivilege 2132 msiexec.exe Token: SeSystemProfilePrivilege 2132 msiexec.exe Token: SeSystemtimePrivilege 2132 msiexec.exe Token: SeProfSingleProcessPrivilege 2132 msiexec.exe Token: SeIncBasePriorityPrivilege 2132 msiexec.exe Token: SeCreatePagefilePrivilege 2132 msiexec.exe Token: SeCreatePermanentPrivilege 2132 msiexec.exe Token: SeBackupPrivilege 2132 msiexec.exe Token: SeRestorePrivilege 2132 msiexec.exe Token: SeShutdownPrivilege 2132 msiexec.exe Token: SeDebugPrivilege 2132 msiexec.exe Token: SeAuditPrivilege 2132 msiexec.exe Token: SeSystemEnvironmentPrivilege 2132 msiexec.exe Token: SeChangeNotifyPrivilege 2132 msiexec.exe Token: SeRemoteShutdownPrivilege 2132 msiexec.exe Token: SeUndockPrivilege 2132 msiexec.exe Token: SeSyncAgentPrivilege 2132 msiexec.exe Token: SeEnableDelegationPrivilege 2132 msiexec.exe Token: SeManageVolumePrivilege 2132 msiexec.exe Token: SeImpersonatePrivilege 2132 msiexec.exe Token: SeCreateGlobalPrivilege 2132 msiexec.exe Token: SeRestorePrivilege 5720 msiexec.exe Token: SeTakeOwnershipPrivilege 5720 msiexec.exe Token: SeRestorePrivilege 5720 msiexec.exe Token: SeTakeOwnershipPrivilege 5720 msiexec.exe Token: SeRestorePrivilege 5720 msiexec.exe Token: SeTakeOwnershipPrivilege 5720 msiexec.exe Token: SeRestorePrivilege 5720 msiexec.exe Token: SeTakeOwnershipPrivilege 5720 msiexec.exe Token: SeRestorePrivilege 5720 msiexec.exe Token: SeTakeOwnershipPrivilege 5720 msiexec.exe Token: SeRestorePrivilege 5720 msiexec.exe Token: SeTakeOwnershipPrivilege 5720 msiexec.exe Token: SeRestorePrivilege 5720 msiexec.exe Token: SeTakeOwnershipPrivilege 5720 msiexec.exe Token: SeRestorePrivilege 5720 msiexec.exe Token: SeTakeOwnershipPrivilege 5720 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2132 msiexec.exe 2132 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2132 msiexec.exe 5720 msiexec.exe 3428 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5720 wrote to memory of 3428 5720 msiexec.exe 87 PID 3428 wrote to memory of 3492 3428 MsiExec.exe 89 PID 3428 wrote to memory of 3492 3428 MsiExec.exe 89
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\dev.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2132
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 19B8319A2A71D9AE3D6E7950ADE7C0002⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\System32\WerFault.exe"3⤵PID:3492
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5900c4.rbs
- Size 1KB
- SHA256 2a9573682762f20dd8996efb0e1c9ae4f117923ee9c33ed0c68d722a8aa56193
- MD5 24f446f4f798d4637eb35bfc5b8fadc0
- SHA1 c56b9998f6f5b4b96382b0c74b0ea9467a0ed022
- SHA512 b6a6b942961377eeba57161b8adc719b5ccd16860f03183d6ddf6f2de1ead81f18fb627d588bac34610270f49b45b93ebd7379395d17b08a4e6e4b304d409971
- TLSH T1DC31F006C3C592C9FDC28AB34772A67C55777E529D34E12CDB09804C6970B8CED69362
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8fc2e.LOG
- Size 20KB
- SHA256 f8abd2e5a60ac6c20cd8d7728832c20f57defdfc736b1a4624a3afaa625af90b
- MD5 3c0dd80878246fb6befd54502bb9942a
- SHA1 2ff421fde10625652860ecbc31a3d0d4e6e8cdc8
- SHA512 8bdd75a935bc24c6836b68ea4bdef0773a014c85b8b8662220c1662f145f4de08fec8fcfa47647662a4c9123f6c0225f8091907e81a69d9f3cef1a4d3352f02b
- SSDEEP 384:oqWq1bQLPicOYjr7GLG8o8nookQ7l1pH8Lne6Bj6PbMuTl6qQ16IPVzLz8KHjmIz:lWqxQbiHsr7GLzZnookQ7l1pH8Lne6B3
- TLSH T14392172A6FF41126F2B7AB479EB358119B77BD122935D84D20C1C25D04B6E04AE7C3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Germys\dermys\revery\zlib1.dll
- Size 585KB
- SHA256 aac94c42b3f06c578e4a0ab71880e242f0b74e6f403d6938966b785e3cfd7b57
- MD5 e5b2605a95d1aa4ce7cdc26bec092a9f
- SHA1 1e219f6fef85704a64b764aada78c2d1c1630c00
- SHA512 00b2d6dc3172ad0e81095310eb385f710e94d2ffc7c56501aec46bbb3bb710baeee3a6e6449e93ae1287c7ca5316d2c3f0706975e26bcb69cb337c220aca8248
- SSDEEP 12288:UM9O5geNjBclTNAad6hPV4PYdKFXpSa3Omg761YrUhCGadefjfFZ:SBclT1d68FXpSaemYrUhCGYeL9Z
- TLSH T142D40285FBC725F3DA330A7744D7523E5978B2022612FDABEB4D27163472712BA482D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI1CB.tmp
- Size 557KB
- SHA256 ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550
- MD5 2c9c51ac508570303c6d46c0571ea3a1
- SHA1 e3e0fe08fa11a43c8bca533f212bdf0704c726d5
- SHA512 df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127
- SSDEEP 6144:j+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOJVafv5khoJQCmR+:j+SuPgAc8+MjGCCslegDTwX5/OCmR+
- TLSH T18BC45A20369AC432D56D16B029ACDBAF912DBE754B3A58DBA3D85E2F45F09C24331F13
- MD5 SHA1 SHA512 SSDEEP TLSH