Analysis
- max time kernel
150s - max time network
155s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe
- Size 2.9MB
- Sample200624-7wslfw9mtj
- SHA256 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52
- MD5 8f620dc7e175bded8b16966b393fec23
- SHA1 3785a16e9b420ab489b730546343c41cca6d62df
- SHA512 8193115523390bc97935aa3ad507aef55c6157372623ed4ebda842c8b6ff2c2adcda94abf5d483e7c896d7b657bb2cbc4bc82fdc64ef0f430a08b5f38ee954bd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
daya4659.ddns.net:8282
Signatures
- Executes dropped EXE 10 IoCs
pid Process 1496 remcos_agent_Protected.exe 4056 remcos_agent_Protected.exe 4088 remcos.exe 2108 remcos.exe 2052 driverquery.exe 4088 sfc.exe 3012 driverquery.exe 3688 sfc.exe 3472 sfc.exe 4008 sfc.exe - Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2804 created 2720 2804 WerFault.exe 90 - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2108 remcos.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe - Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2800 schtasks.exe 3864 schtasks.exe 2184 schtasks.exe 2184 schtasks.exe 1264 schtasks.exe 2996 schtasks.exe - Suspicious use of WriteProcessMemory 342 IoCs
description pid Process procid_target PID 1064 wrote to memory of 1496 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 68 PID 1064 wrote to memory of 1496 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 68 PID 1064 wrote to memory of 1496 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 68 PID 1064 wrote to memory of 1948 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 70 PID 1064 wrote to memory of 1948 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 70 PID 1064 wrote to memory of 1948 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 70 PID 1064 wrote to memory of 2180 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 72 PID 1064 wrote to memory of 2180 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 72 PID 1064 wrote to memory of 2180 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 72 PID 1064 wrote to memory of 2460 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 73 PID 1064 wrote to memory of 2460 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 73 PID 1064 wrote to memory of 2460 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 73 PID 1064 wrote to memory of 2504 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 74 PID 1064 wrote to memory of 2504 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 74 PID 1064 wrote to memory of 2504 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 74 PID 1064 wrote to memory of 2528 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 75 PID 1064 wrote to memory of 2528 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 75 PID 1064 wrote to memory of 2528 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 75 PID 1064 wrote to memory of 2568 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 76 PID 1064 wrote to memory of 2568 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 76 PID 1064 wrote to memory of 2568 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 76 PID 1064 wrote to memory of 2584 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 77 PID 1064 wrote to memory of 2584 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 77 PID 1064 wrote to memory of 2584 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 77 PID 1064 wrote to memory of 2800 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 78 PID 1064 wrote to memory of 2800 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 78 PID 1064 wrote to memory of 2800 1064 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe 78 PID 1496 wrote to memory of 4056 1496 remcos_agent_Protected.exe 80 PID 1496 wrote to memory of 4056 1496 remcos_agent_Protected.exe 80 PID 1496 wrote to memory of 4056 1496 remcos_agent_Protected.exe 80 PID 1496 wrote to memory of 4056 1496 remcos_agent_Protected.exe 80 PID 1496 wrote to memory of 4056 1496 remcos_agent_Protected.exe 80 PID 4056 wrote to memory of 3956 4056 remcos_agent_Protected.exe 81 PID 4056 wrote to memory of 3956 4056 remcos_agent_Protected.exe 81 PID 4056 wrote to memory of 3956 4056 remcos_agent_Protected.exe 81 PID 1496 wrote to memory of 3864 1496 remcos_agent_Protected.exe 82 PID 1496 wrote to memory of 3864 1496 remcos_agent_Protected.exe 82 PID 1496 wrote to memory of 3864 1496 remcos_agent_Protected.exe 82 PID 1948 wrote to memory of 3396 1948 AcroRd32.exe 84 PID 1948 wrote to memory of 3396 1948 AcroRd32.exe 84 PID 1948 wrote to memory of 3396 1948 AcroRd32.exe 84 PID 3956 wrote to memory of 748 3956 WScript.exe 85 PID 3956 wrote to memory of 748 3956 WScript.exe 85 PID 3956 wrote to memory of 748 3956 WScript.exe 85 PID 748 wrote to memory of 4088 748 cmd.exe 87 PID 748 wrote to memory of 4088 748 cmd.exe 87 PID 748 wrote to memory of 4088 748 cmd.exe 87 PID 1948 wrote to memory of 3972 1948 AcroRd32.exe 88 PID 1948 wrote to memory of 3972 1948 AcroRd32.exe 88 PID 1948 wrote to memory of 3972 1948 AcroRd32.exe 88 PID 4088 wrote to memory of 2108 4088 remcos.exe 89 PID 4088 wrote to memory of 2108 4088 remcos.exe 89 PID 4088 wrote to memory of 2108 4088 remcos.exe 89 PID 4088 wrote to memory of 2108 4088 remcos.exe 89 PID 4088 wrote to memory of 2108 4088 remcos.exe 89 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 2108 wrote to memory of 2720 2108 remcos.exe 90 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 1264 3396 RdrCEF.exe 92 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 3396 wrote to memory of 2860 3396 RdrCEF.exe 94 PID 4088 wrote to memory of 2184 4088 remcos.exe 95 PID 4088 wrote to memory of 2184 4088 remcos.exe 95 PID 4088 wrote to memory of 2184 4088 remcos.exe 95 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 3892 3396 RdrCEF.exe 97 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 1560 3396 RdrCEF.exe 98 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3740 3396 RdrCEF.exe 99 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 3396 wrote to memory of 3996 3396 RdrCEF.exe 100 PID 2052 wrote to memory of 3012 2052 driverquery.exe 106 PID 2052 wrote to memory of 3012 2052 driverquery.exe 106 PID 2052 wrote to memory of 3012 2052 driverquery.exe 106 PID 2052 wrote to memory of 3012 2052 driverquery.exe 106 PID 2052 wrote to memory of 3012 2052 driverquery.exe 106 PID 2052 wrote to memory of 2184 2052 driverquery.exe 107 PID 2052 wrote to memory of 2184 2052 driverquery.exe 107 PID 2052 wrote to memory of 2184 2052 driverquery.exe 107 PID 4088 wrote to memory of 3688 4088 sfc.exe 109 PID 4088 wrote to memory of 3688 4088 sfc.exe 109 PID 4088 wrote to memory of 3688 4088 sfc.exe 109 PID 4088 wrote to memory of 3688 4088 sfc.exe 109 PID 4088 wrote to memory of 3688 4088 sfc.exe 109 PID 4088 wrote to memory of 1264 4088 sfc.exe 110 PID 4088 wrote to memory of 1264 4088 sfc.exe 110 PID 4088 wrote to memory of 1264 4088 sfc.exe 110 PID 3472 wrote to memory of 4008 3472 sfc.exe 113 PID 3472 wrote to memory of 4008 3472 sfc.exe 113 PID 3472 wrote to memory of 4008 3472 sfc.exe 113 PID 3472 wrote to memory of 4008 3472 sfc.exe 113 PID 3472 wrote to memory of 4008 3472 sfc.exe 113 PID 3472 wrote to memory of 2996 3472 sfc.exe 114 PID 3472 wrote to memory of 2996 3472 sfc.exe 114 PID 3472 wrote to memory of 2996 3472 sfc.exe 114 - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 2108 remcos.exe 1948 AcroRd32.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 AcroRd32.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe 1948 AcroRd32.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings remcos_agent_Protected.exe - Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1496 set thread context of 4056 1496 remcos_agent_Protected.exe 80 PID 4088 set thread context of 2108 4088 remcos.exe 89 PID 2108 set thread context of 2720 2108 remcos.exe 90 PID 2052 set thread context of 3012 2052 driverquery.exe 106 PID 4088 set thread context of 3688 4088 sfc.exe 109 PID 3472 set thread context of 4008 3472 sfc.exe 113 - Program crash 1 IoCs
pid pid_target Process procid_target 2804 2720 WerFault.exe 90 - UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
resource yara_rule behavioral2/memory/3012-77-0x0000000000400000-0x00000000004C0000-memory.dmp upx - Adds Run entry to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos_agent_Protected.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos_agent_Protected.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-d828 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-d828.exe" driverquery.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos_agent_Protected.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos_agent_Protected.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2804 WerFault.exe Token: SeBackupPrivilege 2804 WerFault.exe Token: SeBackupPrivilege 2804 WerFault.exe Token: SeDebugPrivilege 2804 WerFault.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"1⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
PID:1064 -
C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1496 -
C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Modifies registry class
- Adds Run entry to start application
PID:4056 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exeC:\Users\Admin\AppData\Roaming\remcos\remcos.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:4088 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:2108 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 2849⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F7⤵
- Creates scheduled task(s)
PID:2184
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:3864
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\medical-application-form.pdf"2⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
PID:1948 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵PID:3396
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=984A434A4EAABCF47865C085F20D8F9D --mojo-platform-channel-handle=1640 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1264
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=43523A3A27AC247440B221461A03F013 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=43523A3A27AC247440B221461A03F013 --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:14⤵PID:2860
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EE5593B0B046235C5BCB88C365BFF8C6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EE5593B0B046235C5BCB88C365BFF8C6 --renderer-client-id=4 --mojo-platform-channel-handle=2080 --allow-no-sandbox-job /prefetch:14⤵PID:3892
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BC2E2B6F7383483091A1A40F0D17506F --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1560
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5AA2347D6A8FDC8F2C78CEA956591753 --mojo-platform-channel-handle=2520 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3740
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D0390CDB8AC10BE42863E2B922AEF883 --mojo-platform-channel-handle=2720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3996
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵PID:3972
-
-
-
C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"2⤵PID:2180
-
-
C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"2⤵PID:2460
-
-
C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"2⤵PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"2⤵PID:2528
-
-
C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"2⤵PID:2568
-
-
C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"C:\Users\Admin\AppData\Local\Temp\bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52.exe"2⤵PID:2584
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2800
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exeC:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2052 -
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
- Adds Run entry to start application
PID:3012
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2184
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4088 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:3688
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1264
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3472 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:4008
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2996
-