remcos | 3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b

Analysis

max time kernel
150s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe
Size 2.9MB
Sample201109-debkff1r52
SHA256 3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b
MD5 3a198cef1e0a5b7c0496e34f9b8f7a78
SHA1 8119647a15ad10d8ba0e96d9228a081e8ebe9590
SHA512 1a14e0217ee2119e521d74f4603d6fe24177ca6a4bf1521b207e66e69cf017f93156bfbfb29f02c9b37344a93f3eae4743f0fdfa33ee8229e049543cb6b4c20d
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat upx

Malware Config

Extracted

Family

remcos

daya4659.ddns.net:8282

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2252 created 3156	2252	WerFault.exe	89

ServiceHost packer 6 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/3156-28-0x000000000042800A-mapping.dmp	servicehost
behavioral2/memory/3156-27-0x000000000042800A-mapping.dmp	servicehost
behavioral2/memory/3156-29-0x000000000042800A-mapping.dmp	servicehost
behavioral2/memory/3156-97-0x000000000042800A-mapping.dmp	servicehost
behavioral2/memory/3156-96-0x000000000042800A-mapping.dmp	servicehost
behavioral2/memory/3156-98-0x000000000042800A-mapping.dmp	servicehost

Executes dropped EXE 22 IoCs

pid	Process
3164	remcos_agent_Protected.exe
2224	remcos_agent_Protected.exe
772	remcos.exe
2280	remcos.exe
4624	driverquery.exe
4648	sfc.exe
4680	driverquery.exe
4692	driverquery.exe
4700	driverquery.exe
4712	driverquery.exe
4724	driverquery.exe
4736	driverquery.exe
4820	sfc.exe
4952	driverquery.exe
4980	driverquery.exe
4992	driverquery.exe
5000	driverquery.exe
5012	driverquery.exe
5024	driverquery.exe
5036	driverquery.exe
5068	sfc.exe
4164	sfc.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2836-4-0x0000000000400000-0x00000000004C0000-memory.dmp	upx

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos_agent_Protected.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos_agent_Protected.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos_agent_Protected.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos_agent_Protected.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-8eb2 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-8eb2.exe"	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 640 set thread context of 2836	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	78
PID 3164 set thread context of 2224	3164	remcos_agent_Protected.exe	81
PID 772 set thread context of 2280	772	remcos.exe	88
PID 2280 set thread context of 3156	2280	remcos.exe	89
PID 4648 set thread context of 4820	4648	sfc.exe	115
PID 5068 set thread context of 4164	5068	sfc.exe	128

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	3156	WerFault.exe	89

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4868	schtasks.exe
5092	schtasks.exe
4100	schtasks.exe
1844	schtasks.exe
2092	schtasks.exe
3368	schtasks.exe
4772	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	remcos_agent_Protected.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	remcos.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2836	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2252	WerFault.exe
Token: SeBackupPrivilege	2252	WerFault.exe
Token: SeBackupPrivilege	2252	WerFault.exe
Token: SeDebugPrivilege	2252	WerFault.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe
2280	remcos.exe
2636	AcroRd32.exe

Suspicious use of WriteProcessMemory 363 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3164	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	75
PID 640 wrote to memory of 3164	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	75
PID 640 wrote to memory of 3164	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	75
PID 640 wrote to memory of 2636	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	77
PID 640 wrote to memory of 2636	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	77
PID 640 wrote to memory of 2636	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	77
PID 640 wrote to memory of 2836	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	78
PID 640 wrote to memory of 2836	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	78
PID 640 wrote to memory of 2836	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	78
PID 640 wrote to memory of 2836	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	78
PID 640 wrote to memory of 2836	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	78
PID 640 wrote to memory of 1844	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	79
PID 640 wrote to memory of 1844	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	79
PID 640 wrote to memory of 1844	640	3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe	79
PID 3164 wrote to memory of 2224	3164	remcos_agent_Protected.exe	81
PID 3164 wrote to memory of 2224	3164	remcos_agent_Protected.exe	81
PID 3164 wrote to memory of 2224	3164	remcos_agent_Protected.exe	81
PID 3164 wrote to memory of 2224	3164	remcos_agent_Protected.exe	81
PID 3164 wrote to memory of 2224	3164	remcos_agent_Protected.exe	81
PID 2224 wrote to memory of 2548	2224	remcos_agent_Protected.exe	82
PID 2224 wrote to memory of 2548	2224	remcos_agent_Protected.exe	82
PID 2224 wrote to memory of 2548	2224	remcos_agent_Protected.exe	82
PID 3164 wrote to memory of 2092	3164	remcos_agent_Protected.exe	83
PID 3164 wrote to memory of 2092	3164	remcos_agent_Protected.exe	83
PID 3164 wrote to memory of 2092	3164	remcos_agent_Protected.exe	83
PID 2548 wrote to memory of 3968	2548	WScript.exe	85
PID 2548 wrote to memory of 3968	2548	WScript.exe	85
PID 2548 wrote to memory of 3968	2548	WScript.exe	85
PID 3968 wrote to memory of 772	3968	cmd.exe	87
PID 3968 wrote to memory of 772	3968	cmd.exe	87
PID 3968 wrote to memory of 772	3968	cmd.exe	87
PID 772 wrote to memory of 2280	772	remcos.exe	88
PID 772 wrote to memory of 2280	772	remcos.exe	88
PID 772 wrote to memory of 2280	772	remcos.exe	88
PID 772 wrote to memory of 2280	772	remcos.exe	88
PID 772 wrote to memory of 2280	772	remcos.exe	88
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 2280 wrote to memory of 3156	2280	remcos.exe	89
PID 772 wrote to memory of 3368	772	remcos.exe	92
PID 772 wrote to memory of 3368	772	remcos.exe	92
PID 772 wrote to memory of 3368	772	remcos.exe	92
PID 2636 wrote to memory of 184	2636	AcroRd32.exe	94
PID 2636 wrote to memory of 184	2636	AcroRd32.exe	94
PID 2636 wrote to memory of 184	2636	AcroRd32.exe	94
PID 2636 wrote to memory of 3964	2636	AcroRd32.exe	95
PID 2636 wrote to memory of 3964	2636	AcroRd32.exe	95
PID 2636 wrote to memory of 3964	2636	AcroRd32.exe	95
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 744	184	RdrCEF.exe	96
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 2856	184	RdrCEF.exe	97
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 396	184	RdrCEF.exe	98
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4176	184	RdrCEF.exe	99
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4268	184	RdrCEF.exe	100
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 184 wrote to memory of 4360	184	RdrCEF.exe	101
PID 4624 wrote to memory of 4680	4624	driverquery.exe	107
PID 4624 wrote to memory of 4680	4624	driverquery.exe	107
PID 4624 wrote to memory of 4680	4624	driverquery.exe	107
PID 4624 wrote to memory of 4692	4624	driverquery.exe	108
PID 4624 wrote to memory of 4692	4624	driverquery.exe	108
PID 4624 wrote to memory of 4692	4624	driverquery.exe	108
PID 4624 wrote to memory of 4700	4624	driverquery.exe	109
PID 4624 wrote to memory of 4700	4624	driverquery.exe	109
PID 4624 wrote to memory of 4700	4624	driverquery.exe	109
PID 4624 wrote to memory of 4712	4624	driverquery.exe	110
PID 4624 wrote to memory of 4712	4624	driverquery.exe	110
PID 4624 wrote to memory of 4712	4624	driverquery.exe	110
PID 4624 wrote to memory of 4724	4624	driverquery.exe	111
PID 4624 wrote to memory of 4724	4624	driverquery.exe	111
PID 4624 wrote to memory of 4724	4624	driverquery.exe	111
PID 4624 wrote to memory of 4736	4624	driverquery.exe	112
PID 4624 wrote to memory of 4736	4624	driverquery.exe	112
PID 4624 wrote to memory of 4736	4624	driverquery.exe	112
PID 4624 wrote to memory of 4772	4624	driverquery.exe	113
PID 4624 wrote to memory of 4772	4624	driverquery.exe	113
PID 4624 wrote to memory of 4772	4624	driverquery.exe	113
PID 4648 wrote to memory of 4820	4648	sfc.exe	115
PID 4648 wrote to memory of 4820	4648	sfc.exe	115
PID 4648 wrote to memory of 4820	4648	sfc.exe	115
PID 4648 wrote to memory of 4820	4648	sfc.exe	115
PID 4648 wrote to memory of 4820	4648	sfc.exe	115
PID 4648 wrote to memory of 4868	4648	sfc.exe	116
PID 4648 wrote to memory of 4868	4648	sfc.exe	116
PID 4648 wrote to memory of 4868	4648	sfc.exe	116
PID 4952 wrote to memory of 4980	4952	driverquery.exe	119
PID 4952 wrote to memory of 4980	4952	driverquery.exe	119
PID 4952 wrote to memory of 4980	4952	driverquery.exe	119
PID 4952 wrote to memory of 4992	4952	driverquery.exe	120
PID 4952 wrote to memory of 4992	4952	driverquery.exe	120
PID 4952 wrote to memory of 4992	4952	driverquery.exe	120
PID 4952 wrote to memory of 5000	4952	driverquery.exe	121
PID 4952 wrote to memory of 5000	4952	driverquery.exe	121
PID 4952 wrote to memory of 5000	4952	driverquery.exe	121
PID 4952 wrote to memory of 5012	4952	driverquery.exe	122
PID 4952 wrote to memory of 5012	4952	driverquery.exe	122
PID 4952 wrote to memory of 5012	4952	driverquery.exe	122
PID 4952 wrote to memory of 5024	4952	driverquery.exe	123
PID 4952 wrote to memory of 5024	4952	driverquery.exe	123
PID 4952 wrote to memory of 5024	4952	driverquery.exe	123
PID 4952 wrote to memory of 5036	4952	driverquery.exe	124
PID 4952 wrote to memory of 5036	4952	driverquery.exe	124
PID 4952 wrote to memory of 5036	4952	driverquery.exe	124
PID 4952 wrote to memory of 5092	4952	driverquery.exe	126
PID 4952 wrote to memory of 5092	4952	driverquery.exe	126
PID 4952 wrote to memory of 5092	4952	driverquery.exe	126
PID 5068 wrote to memory of 4164	5068	sfc.exe	128
PID 5068 wrote to memory of 4164	5068	sfc.exe	128
PID 5068 wrote to memory of 4164	5068	sfc.exe	128
PID 5068 wrote to memory of 4164	5068	sfc.exe	128
PID 5068 wrote to memory of 4164	5068	sfc.exe	128
PID 5068 wrote to memory of 4100	5068	sfc.exe	129
PID 5068 wrote to memory of 4100	5068	sfc.exe	129
PID 5068 wrote to memory of 4100	5068	sfc.exe	129

C:\Users\Admin\AppData\Local\Temp\3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe
"C:\Users\Admin\AppData\Local\Temp\3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe
  "C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe
    "C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3968
      - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 568
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Drops file in Windows directory
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:3368
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:2092
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\medical-application-form.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:184
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EAB6C9FB95C294D3F9F982DDAD7832CC --mojo-platform-channel-handle=1632 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:744
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5D899B61D237AD9D6073B3891C47CDF4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5D899B61D237AD9D6073B3891C47CDF4 --renderer-client-id=2 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FCBA83C2F6118291B779A223F01E5F05 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FCBA83C2F6118291B779A223F01E5F05 --renderer-client-id=4 --mojo-platform-channel-handle=2072 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:396
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=332C55653F4639E837E7740698A4B419 --mojo-platform-channel-handle=1688 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E6E40F28A2F5BDCE9FC49B57698D36AC --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=27E64476D7AD0F7B6B1600EFB32DCB20 --mojo-platform-channel-handle=2596 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4360
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:3964
- C:\Users\Admin\AppData\Local\Temp\3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe
  "C:\Users\Admin\AppData\Local\Temp\3ec6d00a4d3dbb78e50ec84b113f8cc3b254b974ce0218c5bf840e662e7a416b.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: RenamesItself
  PID:2836
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1844

C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
1⤵
- Executes dropped EXE
PID:4624
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4772

C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4648
- C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
  "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4868

C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
1⤵
- Executes dropped EXE
PID:4952
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:5092

C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5068
- C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
  "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-153-0x0000000077BF2000-0x0000000077BF200C-memory.dmp

Download

memory/744-145-0x0000000077BF2000-0x0000000077BF200C-memory.dmp

Download

memory/2224-7-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2252-123-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-105-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-107-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-108-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-109-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-112-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-25-0x0000000004720000-0x0000000004721000-memory.dmp

Download

memory/2252-113-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-114-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-110-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-115-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-116-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-117-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-118-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-119-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-120-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-121-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-122-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-30-0x0000000004910000-0x0000000004911000-memory.dmp

Download

memory/2252-124-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-126-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-125-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-127-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-128-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-129-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-130-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-131-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-132-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-133-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-134-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-135-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-136-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-137-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-138-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-139-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-140-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-141-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-142-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-143-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-106-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-103-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-99-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-100-0x0000000004A00000-0x0000000004A01000-memory.dmp

Download

memory/2252-104-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-102-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2252-101-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/2836-4-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/2856-148-0x0000000077BF2000-0x0000000077BF200C-memory.dmp

Download

memory/3156-21-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/3156-23-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/4164-194-0x0000000000350000-0x0000000000370000-memory.dmp

Download

memory/4176-158-0x0000000077BF2000-0x0000000077BF200C-memory.dmp

Download

memory/4268-161-0x0000000077BF2000-0x0000000077BF200C-memory.dmp

Download

memory/4360-164-0x0000000077BF2000-0x0000000077BF200C-memory.dmp

Download