Analysis
- max time kernel
149s - max time network
153s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe
- Size 2.9MB
- Sample200624-ltg4th3ya6
- SHA256 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07
- MD5 b3052bfc549c5977094b87c288030f2f
- SHA1 89c0f3f5ee9aeab197835ba44348b2cf47b6235a
- SHA512 070425c1600499b2aad5d0d5d585a7ee6ff15068fe4b320058af1033abee7a0cb3b0a88db55f3ac835a6ede6b1d9b6f0a59ef8304a3e1793a087e5af8d004420
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
daya4659.ddns.net:8282
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe - Suspicious use of WriteProcessMemory 343 IoCs
description pid Process procid_target PID 3656 wrote to memory of 428 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 66 PID 3656 wrote to memory of 428 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 66 PID 3656 wrote to memory of 428 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 66 PID 3656 wrote to memory of 908 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 68 PID 3656 wrote to memory of 908 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 68 PID 3656 wrote to memory of 908 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 68 PID 3656 wrote to memory of 1004 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 69 PID 3656 wrote to memory of 1004 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 69 PID 3656 wrote to memory of 1004 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 69 PID 3656 wrote to memory of 1004 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 69 PID 3656 wrote to memory of 1004 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 69 PID 3656 wrote to memory of 1096 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 70 PID 3656 wrote to memory of 1096 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 70 PID 3656 wrote to memory of 1096 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 70 PID 428 wrote to memory of 1476 428 remcos_agent_Protected.exe 72 PID 428 wrote to memory of 1476 428 remcos_agent_Protected.exe 72 PID 428 wrote to memory of 1476 428 remcos_agent_Protected.exe 72 PID 428 wrote to memory of 1476 428 remcos_agent_Protected.exe 72 PID 428 wrote to memory of 1476 428 remcos_agent_Protected.exe 72 PID 1476 wrote to memory of 1852 1476 remcos_agent_Protected.exe 73 PID 1476 wrote to memory of 1852 1476 remcos_agent_Protected.exe 73 PID 1476 wrote to memory of 1852 1476 remcos_agent_Protected.exe 73 PID 428 wrote to memory of 2116 428 remcos_agent_Protected.exe 74 PID 428 wrote to memory of 2116 428 remcos_agent_Protected.exe 74 PID 428 wrote to memory of 2116 428 remcos_agent_Protected.exe 74 PID 1852 wrote to memory of 3176 1852 WScript.exe 78 PID 1852 wrote to memory of 3176 1852 WScript.exe 78 PID 1852 wrote to memory of 3176 1852 WScript.exe 78 PID 3176 wrote to memory of 3468 3176 cmd.exe 80 PID 3176 wrote to memory of 3468 3176 cmd.exe 80 PID 3176 wrote to memory of 3468 3176 cmd.exe 80 PID 3468 wrote to memory of 2324 3468 remcos.exe 83 PID 3468 wrote to memory of 2324 3468 remcos.exe 83 PID 3468 wrote to memory of 2324 3468 remcos.exe 83 PID 3468 wrote to memory of 2324 3468 remcos.exe 83 PID 3468 wrote to memory of 2324 3468 remcos.exe 83 PID 2324 wrote to memory of 3900 2324 remcos.exe 84 PID 2324 wrote to memory of 3900 2324 remcos.exe 84 PID 2324 wrote to memory of 3900 2324 remcos.exe 84 PID 3468 wrote to memory of 1952 3468 remcos.exe 85 PID 3468 wrote to memory of 1952 3468 remcos.exe 85 PID 3468 wrote to memory of 1952 3468 remcos.exe 85 PID 3076 wrote to memory of 972 3076 driverquery.exe 87 PID 3076 wrote to memory of 972 3076 driverquery.exe 87 PID 3076 wrote to memory of 972 3076 driverquery.exe 87 PID 3076 wrote to memory of 972 3076 driverquery.exe 87 PID 3076 wrote to memory of 972 3076 driverquery.exe 87 PID 3076 wrote to memory of 3768 3076 driverquery.exe 88 PID 3076 wrote to memory of 3768 3076 driverquery.exe 88 PID 3076 wrote to memory of 3768 3076 driverquery.exe 88 PID 908 wrote to memory of 1604 908 AcroRd32.exe 91 PID 908 wrote to memory of 1604 908 AcroRd32.exe 91 PID 908 wrote to memory of 1604 908 AcroRd32.exe 91 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 1844 1604 RdrCEF.exe 92 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 3916 1604 RdrCEF.exe 93 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 1508 1604 RdrCEF.exe 94 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 416 1604 RdrCEF.exe 95 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3488 1604 RdrCEF.exe 96 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 1604 wrote to memory of 3028 1604 RdrCEF.exe 97 PID 3132 wrote to memory of 792 3132 sfc.exe 98 PID 3132 wrote to memory of 792 3132 sfc.exe 98 PID 3132 wrote to memory of 792 3132 sfc.exe 98 PID 3132 wrote to memory of 792 3132 sfc.exe 98 PID 3132 wrote to memory of 792 3132 sfc.exe 98 PID 3132 wrote to memory of 3580 3132 sfc.exe 99 PID 3132 wrote to memory of 3580 3132 sfc.exe 99 PID 3132 wrote to memory of 3580 3132 sfc.exe 99 PID 2620 wrote to memory of 2252 2620 driverquery.exe 106 PID 2620 wrote to memory of 2252 2620 driverquery.exe 106 PID 2620 wrote to memory of 2252 2620 driverquery.exe 106 PID 2620 wrote to memory of 2252 2620 driverquery.exe 106 PID 2620 wrote to memory of 2252 2620 driverquery.exe 106 PID 2620 wrote to memory of 4084 2620 driverquery.exe 107 PID 2620 wrote to memory of 4084 2620 driverquery.exe 107 PID 2620 wrote to memory of 4084 2620 driverquery.exe 107 PID 3344 wrote to memory of 3076 3344 sfc.exe 109 PID 3344 wrote to memory of 3076 3344 sfc.exe 109 PID 3344 wrote to memory of 3076 3344 sfc.exe 109 PID 3344 wrote to memory of 3076 3344 sfc.exe 109 PID 3344 wrote to memory of 3076 3344 sfc.exe 109 PID 3344 wrote to memory of 3448 3344 sfc.exe 110 PID 3344 wrote to memory of 3448 3344 sfc.exe 110 PID 3344 wrote to memory of 3448 3344 sfc.exe 110 PID 4068 wrote to memory of 3080 4068 driverquery.exe 114 PID 4068 wrote to memory of 3080 4068 driverquery.exe 114 PID 4068 wrote to memory of 3080 4068 driverquery.exe 114 PID 4068 wrote to memory of 3080 4068 driverquery.exe 114 PID 4068 wrote to memory of 3080 4068 driverquery.exe 114 PID 4068 wrote to memory of 2912 4068 driverquery.exe 115 PID 4068 wrote to memory of 2912 4068 driverquery.exe 115 PID 4068 wrote to memory of 2912 4068 driverquery.exe 115 PID 692 wrote to memory of 3768 692 sfc.exe 117 PID 692 wrote to memory of 3768 692 sfc.exe 117 PID 692 wrote to memory of 3768 692 sfc.exe 117 PID 692 wrote to memory of 3768 692 sfc.exe 117 PID 692 wrote to memory of 3768 692 sfc.exe 117 PID 692 wrote to memory of 3340 692 sfc.exe 118 PID 692 wrote to memory of 3340 692 sfc.exe 118 PID 692 wrote to memory of 3340 692 sfc.exe 118 - Executes dropped EXE 16 IoCs
pid Process 428 remcos_agent_Protected.exe 1476 remcos_agent_Protected.exe 3468 remcos.exe 3076 driverquery.exe 3132 sfc.exe 2324 remcos.exe 972 driverquery.exe 792 sfc.exe 3344 sfc.exe 2620 driverquery.exe 2252 driverquery.exe 3076 sfc.exe 692 sfc.exe 4068 driverquery.exe 3080 driverquery.exe 3768 sfc.exe - Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 3656 set thread context of 1004 3656 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe 69 PID 428 set thread context of 1476 428 remcos_agent_Protected.exe 72 PID 3468 set thread context of 2324 3468 remcos.exe 83 PID 3076 set thread context of 972 3076 driverquery.exe 87 PID 3132 set thread context of 792 3132 sfc.exe 98 PID 2620 set thread context of 2252 2620 driverquery.exe 106 PID 3344 set thread context of 3076 3344 sfc.exe 109 PID 4068 set thread context of 3080 4068 driverquery.exe 114 PID 692 set thread context of 3768 692 sfc.exe 117 - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 2324 remcos.exe 908 AcroRd32.exe - Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1952 schtasks.exe 3768 schtasks.exe 4084 schtasks.exe 2912 schtasks.exe 3340 schtasks.exe 1096 schtasks.exe 2116 schtasks.exe 3580 schtasks.exe 3448 schtasks.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1004 cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings remcos_agent_Protected.exe - Adds Run entry to start application 2 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos_agent_Protected.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos_agent_Protected.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos_agent_Protected.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos_agent_Protected.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-d828 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-d828.exe销" cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 908 AcroRd32.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe 908 AcroRd32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2324 remcos.exe - UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
resource yara_rule behavioral2/memory/1004-4-0x0000000000400000-0x00000000004C0000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe"C:\Users\Admin\AppData\Local\Temp\cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Modifies registry class
PID:3656 -
C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:428 -
C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Modifies registry class
- Adds Run entry to start application
PID:1476 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exeC:\Users\Admin\AppData\Roaming\remcos\remcos.exe6⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3468 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"7⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:2324 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3900
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F7⤵
- Creates scheduled task(s)
PID:1952
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2116
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\medical-application-form.pdf"2⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
PID:908 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=11699EB1F1376BF968CFB47CAEACC859 --mojo-platform-channel-handle=1620 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1844
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3000FB33855E797CB2A49FA06B607E47 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3000FB33855E797CB2A49FA06B607E47 --renderer-client-id=2 --mojo-platform-channel-handle=1640 --allow-no-sandbox-job /prefetch:14⤵PID:3916
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=42025F697CC11B97C9D10C7FFB9E63F0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=42025F697CC11B97C9D10C7FFB9E63F0 --renderer-client-id=4 --mojo-platform-channel-handle=2080 --allow-no-sandbox-job /prefetch:14⤵PID:1508
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2BE622EFA07CD52945146914459DDA5C --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:416
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0C2873A384667F03424A87CA1449D346 --mojo-platform-channel-handle=2452 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3488
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C2114F3DDA4BD8CC9D8B53327E99F672 --mojo-platform-channel-handle=2616 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3028
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe"C:\Users\Admin\AppData\Local\Temp\cbffffdb51c8b3351cb3c2fc8011a5ecb90dee60bbf482ccae90a64603a00b07.exe"2⤵
- Suspicious behavior: RenamesItself
- Adds Run entry to start application
PID:1004
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1096
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exeC:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3076 -
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
PID:972
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3768
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3132 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:792
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3580
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3344 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:3076
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3448
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exeC:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2620 -
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
PID:2252
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4084
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:692 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:3768
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3340
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exeC:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4068 -
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
PID:3080
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2912
-