Managed XDR

2025-09-02_df66a1d3065...a-stealer_njrat_remcos — malware analysis report

File info

Filename
2025-09-02_df66a1d3065cd5cf940fd89c22e4483d_amadey_black-basta_coinminer_elex_luca-stealer_njrat_remcos
File type
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
File size
1.6 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
855917a9899629629764f52926a4c91fd6fe0693
SHA256
d9b9292fcba0600fc2ffd691aef8668a441bc975e9b5224e5d018b1f6b3d3233
MD5
df66a1d3065cd5cf940fd89c22e4483d

Signatures

Execution

T1047 has_wmi: Executes one or several WMI requests

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1562 registry_hide_tracing: Modifies File/Console tracing settings (often used to hide iocs from the system)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1083 crawls_directories: Opens a huge number of directories all over disk C: (possibly, searches for sensitive data)
T1057 process_interest: Enumerates processes
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antivm_queries_computername: Retrieves the computer name

Collection

T1074.001 access_recyclebin: Manipulation with recyclebin detected

Command and Control

T1071.001 wininet_openurl: Performs HTTP/HTTPS-requests using InternetOpenUrl

Impact

T1486 modifies_files2: Cryptolocker indicators detected (500 or more files are modified)
T1486 modifies_files: Cryptolocker indicators detected (renamed 500 or more files)
T1490 vssadmin_delete_shadows: Attempt to delete volume shadow copies
T1486 ransomware_message: Ransomware indicators detected (possible ransom message creation)
T1489 service_control_stop: Stops services via ControlService

Other

yara_rules: Static rules
creates_in_windows: Creates files in the Windows directory
modifies_certs: Attempts to generate or modify system certificates
create_rpc_bindings: Creates RPC connection
get_policy_info: Retrieves information about a Policy object
creates_in_programdata: Creates files in the ProgramData directory
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
writes_data: Writes big amount of data to disk
suricata_alert: Malicious traffic detected