remus_stealer | 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

General

Target
Setup.exe
Size 102KB
Sample260822-akxtbstyby
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

C2

http://kupzovo.shop:7567/posts
http://vexdico.shop:8539/webhooks
http://mrlketo.shop:8932/orders

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Executes dropped EXE 1 IoCs

pid	Process
3676	526993537.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe:Zone.Identifier	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5460	cmd.exe
4504	cmd.exe
4812	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3940	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3676	526993537.exe
3676	526993537.exe
3676	526993537.exe
3676	526993537.exe
3676	526993537.exe
3676	526993537.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 5460	1080	Setup.exe	89
PID 1080 wrote to memory of 4504	1080	Setup.exe	91
PID 1080 wrote to memory of 4812	1080	Setup.exe	93
PID 1080 wrote to memory of 3676	1080	Setup.exe	95
PID 1080 wrote to memory of 3940	1080	Setup.exe	97

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4812
- C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe
  C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Windows\SYSTEM32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Browser Information Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

526993537.exe

Path C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\526993537.exe
Size 5.1MB
SHA256 6a406376be3f0dc3c700a8c637b5c4a111c8e013b49f2100dace21520aeec4b8
MD5 3e32d60a5fb71b7a658d69b31402934f
SHA1 03340851d47839d344cfb8c1880aff5b164de902
SHA512 9221a899e073f21388584c482bfb26b0402d1b4a017c647fc83a5da3df096b3ee6201c4098f64a9e5838b55144f0036895ea64988098bcabfbca9d382a70c135
SSDEEP 49152:S+Ux99IDm1FYHvHW5pbEvBDFT1FUrg7TmXi:pQ9kci/0uJFFXb
TLSH
T131365A07BCA545A9C0AAA734C9A787127B75BC88873233D72E50BA383F76BD05E75740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Local\Temp\data\saves\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/3676-273-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/3676-274-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/3676-275-0x0000000140000000-0x000000014003B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads