binance.exe
Remcos RAT with credential theft
Unmap-based RunPE process hollowingWinlogon Userinit persistence
SHA-256d31a285b4e79088b7b8a841c216e533311e107f386684e81c1acdddaedaa7123
Evidence
⋯7 more rows
0x84d4abababab8d45f0508d45ac5033c05050.....E.P.E.P3.PP
0x84e468000000085050506878114100685c11h....PPPhx.A.h\.
0x84f44100ff15ac004100ff75f08b35580141A.....A..u..5X.A
0x850400ffd6ff75f4ffd65f5ec9c3558bec53....u..._^..U..S
0x851456578b7d088bf13bf70f84f40000008bVW.}...;........
⋯13 more rows
⋯6 more rows
0xfff000000000000000000000000000000000................
0x100003e2b0100262b01000e2b0100fc2a0100>+..&+...+...*..
0x10010e82a0100d82a0100c82a0100b62a0100.*...*...*...*..
0x10020a62a0100942a0100522a0100622a0100.*...*..R*..b*..
0x10030722a0100802a0100522b010000000000r*...*..R+......
0x100403c2a0100262a0100162a0100fc290100<*..&*...*...)..
0x10050ec290100de290100d0290100c4290100.)...)...)...)..
0x10060b4290100a829010000000000d8230100.)...).......#..
0x10070ee230100022401001224010020240100.#...$...$.. $..
0x1008030240100422401005e240100702401000$..B$..^$..p$..
0x100908024010090240100a0240100b2240100.$...$...$...$..
0x100a0c4240100d6240100e2240100f2240100.$...$...$...$..
0x100b004250100142501002425010032250100.%...%..$%..2%..
0x100c0402501004a25010060250100cc230100@%..J%..`%...#..
0x100d08225010098250100b2250100c6250100.%...%...%...%..
0x100e0d6250100ea2501000026010012260100.%...%...&...&..
0x100f0262601003a2601004a26010058260100&&..:&..J&..X&..
0x10100662601007a2601008626010096260100f&..z&...&...&..
0x10110a6260100b4260100c2260100d4260100.&...&...&...&..
0x10120e8260100f426010002270100784a0100.&...&...'..xJ..
0x10130b02301009e2301008e2301007e230100.#...#...#..~#..
0x101406e2301005c2301004623010034230100n#..\#..F#..4#..
0x10150262301001223010004230100ee220100&#...#...#..."..
0x10160d8220100cc220100ba220100a8220100."..."..."..."..
0x10170982201008c2201007c2201006c220100."..."..|"..l"..
0x101805622010042220100342201002c220100V"..B"..4"..,"..
0x1019018220100742501000822010000000000."..t%..."......
0x101a0823f0100343f0100da3e0100803e0100.?..4?...>...>..
0x101b02e3e0100dc3d0100883d01002c3d0100.>...=...=..,=..
0x101c02a40010080400100d240010022410100*@...@...@.."A..
0x101d078410100c84101001242010064420100xA...A...B..dB..
0x101e084420100a4420100bc420100d4420100.B...B...B...B..
0x101f02843010080430100d643010026440100(C...C...C..&D..
0x102007a440100ca4401001845010068450100zD...D...E..hE..
0x10210b645010004460100d23f0100e63c0100.E...F...?...<..
0x10220963c0100383c0100e83b0100aa3b0100.<..8<...;...;..
⋯6 more rows
0x1031c0c480100f8470100ec470100dc470100.H...G...G...G..
0x1032cd2470100c4470100bc470100b2470100.G...G...G...G..
0x1033ca44701008c470100784701006e470100.G...G..xG..nG..
0x1034c664701005e4701005247010048470100fG..^G..RG..HG..
0x1035c8a4a010032470100284701001e470100.J..2G..(G...G..
⋯4 more rows
0x103ac40460100484601006446010000000000@F..HF..dF......
0x103bc702b0100b62b0100a22b0100902b0100p+...+...+...+..
0x103cc802b010000000000dc48010000000000.+.......H......
0x103dcbe270100d6270100ec27010002280100.'...'...'...(..
0x103ec1428010028280100382801004c280100.(..((..8(..L(..
0x103fc5e2801006e2801007c28010096280100^(..n(..|(...(..
0x1040cb2280100c0280100ac270100e0280100.(...(...'...(..
0x1041cf2280100002901000c2901001e290100.(...)...)...)..
0x1042c322901004029010052290100642901002)..@)..R)..d)..
0x1043c7a2901008a2901009e2701008c270100z)...)...'...'..
0x1044c782701006a270100562701002e270100x'..j'..V'...'..
0x1045c2027010042270100ce28010000000000 '..B'...(......
0x1046c1e4a0100484a01005c4a0100344a0100.J..HJ..\J..4J..
0x1047c0000000068480100c4480100b6480100....hH...H...H..
0x1048c76480100884801009e4801005a480100vH...H...H..ZH..
0x1049c00000000090000803400008003000080........4.......
0x104ac17000080130000806f00008004000080........o.......
0x104bc10000080730000800000000088490100....s........I..
0x104ccb2490100c6490100d8490100e4490100.I...I...I...I..
0x104dcfc4901006e4901005c49010044490100.I..nI..\I..DI..
0x104eca6490100284901000000000006490100.I..(I.......I..
0x104fc0000000053626965446c6c2e646c6c00....SbieDll.dll.
0x1050c00000000ffffffff571140005b114000........W.@.[.@.
⋯9 more rows
0x105ac000000002e7761760000000025592d25.....wav....%Y-%
0x105bc6d2d25642025482e254d000067657463m-%d %H.%M..getc
0x105cc616d73696e676c656672616d65000000amsingleframe...
0x105dc6e6f63616d6572610000000073746172nocamera....star
⋯3 more rows
⋯7 more rows
0x109f820000000205b4374726c202b20565d0a ... [Ctrl + V].
0x10a085b466f6c6c6f77696e67207465787420[Following text
0x10a18686173206265656e2070617374656420has been pasted
0x10a2866726f6d20636c6970626f6172643a5dfrom clipboard:]
0x10a380a0000000a5b456e64206f6620636c69.....[End of cli
0x10a4870626f61726420746578745d0a000000pboard text]....
0x10a58205b4374726c202b2000000080000000 [Ctrl + .......
0x10a68205b4c4374726c5d20000000205b5243 [LCtrl] ... [RC
0x10a7874726c5d200000000d0a5b466f6c6c6ftrl] .....[Follo
0x10a8877696e67207465787420686173206265wing text has be
0x10a98656e20636f7069656420746f20636c69en copied to cli
0x10aa870626f6172643a5d0d0a00000d0a5b45pboard:]......[E
0x10ab86e64206f6620636c6970626f61726420nd of clipboard
0x10ac8746578745d0d0a000a5b4368726f6d65text]....[Chrome
0x10ad82053746f7265644c6f67696e7320666f StoredLogins fo
0x10ae8756e642c20636c6561726564215d0000und, cleared!]..
0x10af80a5b4368726f6d652053746f7265644c.[Chrome StoredL
0x10b086f67696e73206e6f7420666f756e645dogins not found]
0x10b18000000005573657250726f66696c6500....UserProfile.
0x10b285c417070446174615c4c6f63616c5c47\AppData\Local\G
0x10b386f6f676c655c4368726f6d655c557365oogle\Chrome\Use
0x10b487220446174615c44656661756c745c4cr Data\Default\L
0x10b586f67696e20446174610000000a5b4368ogin Data....[Ch
0x10b68726f6d6520436f6f6b69657320666f75rome Cookies fou
0x10b786e642c20636c6561726564215d000000nd, cleared!]...
0x10b880a5b4368726f6d6520436f6f6b696573.[Chrome Cookies
0x10b98206e6f7420666f756e645d005c417070 not found].\App
0x10ba8446174615c4c6f63616c5c476f6f676cData\Local\Googl
0x10bb8655c4368726f6d655c55736572204461e\Chrome\User Da
0x10bc874615c44656661756c745c436f6f6b69ta\Default\Cooki
0x10bd8657300000a5b46697265666f78205374es...[Firefox St
0x10be86f7265644c6f67696e7320636c656172oredLogins clear
0x10bf86564215d000000005c6b6579332e6462ed!]....\key3.db
0x10c08000000005c6c6f67696e732e6a736f6e....\logins.json
0x10c18000000002e2e00000a5b46697265666f.........[Firefo
0x10c28782053746f7265644c6f67696e73206ex StoredLogins n
0x10c386f7420666f756e645d0000005c417070ot found]...\App
0x10c48446174615c526f616d696e675c4d6f7aData\Roaming\Moz
0x10c58696c6c615c46697265666f785c50726filla\Firefox\Pro
0x10c6866696c65735c00000a5b46697265666ffiles\...[Firefo
0x10c787820636f6f6b69657320666f756e642cx cookies found,
⋯7 more rows
0x115f466726f6d6c6f63616c746f66696c6500fromlocaltofile.
0x11604646f776e6c6f616466726f6d75726c74downloadfromurlt
0x116146f66696c6500000066696c656d677200ofile...filemgr.
0x116246b656570616c6976656f666600000000keepaliveoff....
⋯16 more rows
0x117342569000077696e646f77736c69737400%i..windowslist.
0x11744536553687574646f776e50726976696cSeShutdownPrivil
0x11754656765006572725f6e6f746f70656e66ege.err_notopenf
0x11764696c650066696c65646f776e00000000ile.filedown....
⋯3 more rows
0x117a46364000065786563000000006e74646ccd..exec....ntdl
0x117b46c2e646c6c0000004e74556e6d617056l.dll...NtUnmapV
0x117c46965774f6653656374696f6e00000000iewOfSection....
0x117d4444953504c41590073637273686f7400DISPLAY.scrshot.
0x117e469006d006100670065002f006a007000i.m.a.g.e./.j.p.
0x117f4650067000000000075dd4000b0dd4000e.g.....u.@...@.
0x118046461740069006d006100670065002f00dat.i.m.a.g.e./.
0x1181470006e00670000002e706e6700000000p.n.g....png....
0x118245573657233322e646c6c00004765744cUser32.dll..GetL
0x11834617374496e707574496e666f00000000astInputInfo....
0x118445c2f00002f0000002e65786500000000\/../....exe....
0x11854687474705c7368656c6c5c6f70656e5chttp\shell\open\
0x11864636f6d6d616e64006162636465666768command.abcdefgh
0x11874696a6b6c6d6e6f707172737475767778ijklmnopqrstuvwx