remcos | fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463

Analysis

max time kernel
26s
max time network
14s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
Size 2.9MB
Sample201109-ghjpyvdfhs
SHA256 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463
MD5 98feed3d432c78a7c6399466aa5c89c2
SHA1 e1efaa681ddc3314d688d6a2a21186c47faa7cd5
SHA512 b34c0752a8b6d577f7cfba0ad2a7d48f6ed682a0666c7d8ebaeee0942760676b169105548733de13b28b4dd0b5de243fae28df7779167c2fdb6bb9cc8b3797c1
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

daya4659.ddns.net:8282

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 13 IoCs

pid	Process
1568	remcos_agent_Protected.exe
1704	remcos_agent_Protected.exe
1180	remcos.exe
640	remcos.exe
800	sfc.exe
364	driverquery.exe
940	sfc.exe
1180	driverquery.exe
1748	driverquery.exe
1824	driverquery.exe
2012	driverquery.exe
1612	driverquery.exe
1608	driverquery.exe

Loads dropped DLL 6 IoCs

pid	Process
1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
1568	remcos_agent_Protected.exe
664	cmd.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos_agent_Protected.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos_agent_Protected.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos_agent_Protected.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos_agent_Protected.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1568 set thread context of 1704	1568	remcos_agent_Protected.exe	36
PID 1180 set thread context of 640	1180	remcos.exe	46
PID 640 set thread context of 952	640	remcos.exe	47
PID 640 set thread context of 1996	640	remcos.exe	50
PID 640 set thread context of 1680	640	remcos.exe	51
PID 640 set thread context of 1424	640	remcos.exe	52
PID 640 set thread context of 316	640	remcos.exe	53
PID 640 set thread context of 1304	640	remcos.exe	54
PID 640 set thread context of 1428	640	remcos.exe	55
PID 800 set thread context of 940	800	sfc.exe	59

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1168	schtasks.exe
1604	schtasks.exe
1296	schtasks.exe
1152	schtasks.exe
1532	schtasks.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2032	AcroRd32.exe
2032	AcroRd32.exe
2032	AcroRd32.exe
640	remcos.exe

Suspicious use of WriteProcessMemory 191 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1568	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	26
PID 1756 wrote to memory of 1568	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	26
PID 1756 wrote to memory of 1568	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	26
PID 1756 wrote to memory of 1568	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	26
PID 1756 wrote to memory of 2032	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	27
PID 1756 wrote to memory of 2032	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	27
PID 1756 wrote to memory of 2032	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	27
PID 1756 wrote to memory of 2032	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	27
PID 1756 wrote to memory of 1124	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	28
PID 1756 wrote to memory of 1124	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	28
PID 1756 wrote to memory of 1124	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	28
PID 1756 wrote to memory of 1124	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	28
PID 1756 wrote to memory of 2040	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	29
PID 1756 wrote to memory of 2040	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	29
PID 1756 wrote to memory of 2040	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	29
PID 1756 wrote to memory of 2040	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	29
PID 1756 wrote to memory of 904	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	30
PID 1756 wrote to memory of 904	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	30
PID 1756 wrote to memory of 904	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	30
PID 1756 wrote to memory of 904	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	30
PID 1756 wrote to memory of 1308	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	31
PID 1756 wrote to memory of 1308	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	31
PID 1756 wrote to memory of 1308	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	31
PID 1756 wrote to memory of 1308	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	31
PID 1756 wrote to memory of 1980	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	32
PID 1756 wrote to memory of 1980	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	32
PID 1756 wrote to memory of 1980	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	32
PID 1756 wrote to memory of 1980	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	32
PID 1756 wrote to memory of 2016	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	33
PID 1756 wrote to memory of 2016	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	33
PID 1756 wrote to memory of 2016	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	33
PID 1756 wrote to memory of 2016	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	33
PID 1756 wrote to memory of 1152	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	34
PID 1756 wrote to memory of 1152	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	34
PID 1756 wrote to memory of 1152	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	34
PID 1756 wrote to memory of 1152	1756	fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe	34
PID 1568 wrote to memory of 1704	1568	remcos_agent_Protected.exe	36
PID 1568 wrote to memory of 1704	1568	remcos_agent_Protected.exe	36
PID 1568 wrote to memory of 1704	1568	remcos_agent_Protected.exe	36
PID 1568 wrote to memory of 1704	1568	remcos_agent_Protected.exe	36
PID 1568 wrote to memory of 1704	1568	remcos_agent_Protected.exe	36
PID 1568 wrote to memory of 1704	1568	remcos_agent_Protected.exe	36
PID 1704 wrote to memory of 1336	1704	remcos_agent_Protected.exe	37
PID 1704 wrote to memory of 1336	1704	remcos_agent_Protected.exe	37
PID 1704 wrote to memory of 1336	1704	remcos_agent_Protected.exe	37
PID 1704 wrote to memory of 1336	1704	remcos_agent_Protected.exe	37
PID 1568 wrote to memory of 1532	1568	remcos_agent_Protected.exe	38
PID 1568 wrote to memory of 1532	1568	remcos_agent_Protected.exe	38
PID 1568 wrote to memory of 1532	1568	remcos_agent_Protected.exe	38
PID 1568 wrote to memory of 1532	1568	remcos_agent_Protected.exe	38
PID 1336 wrote to memory of 664	1336	WScript.exe	40
PID 1336 wrote to memory of 664	1336	WScript.exe	40
PID 1336 wrote to memory of 664	1336	WScript.exe	40
PID 1336 wrote to memory of 664	1336	WScript.exe	40
PID 664 wrote to memory of 1180	664	cmd.exe	42
PID 664 wrote to memory of 1180	664	cmd.exe	42
PID 664 wrote to memory of 1180	664	cmd.exe	42
PID 664 wrote to memory of 1180	664	cmd.exe	42
PID 1180 wrote to memory of 640	1180	remcos.exe	46
PID 1180 wrote to memory of 640	1180	remcos.exe	46
PID 1180 wrote to memory of 640	1180	remcos.exe	46
PID 1180 wrote to memory of 640	1180	remcos.exe	46
PID 1180 wrote to memory of 640	1180	remcos.exe	46
PID 1180 wrote to memory of 640	1180	remcos.exe	46
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 640 wrote to memory of 952	640	remcos.exe	47
PID 1180 wrote to memory of 1168	1180	remcos.exe	48
PID 1180 wrote to memory of 1168	1180	remcos.exe	48
PID 1180 wrote to memory of 1168	1180	remcos.exe	48
PID 1180 wrote to memory of 1168	1180	remcos.exe	48
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1996	640	remcos.exe	50
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1680	640	remcos.exe	51
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 1424	640	remcos.exe	52
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 316	640	remcos.exe	53
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1304	640	remcos.exe	54
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 640 wrote to memory of 1428	640	remcos.exe	55
PID 1320 wrote to memory of 364	1320	taskeng.exe	58
PID 1320 wrote to memory of 364	1320	taskeng.exe	58
PID 1320 wrote to memory of 364	1320	taskeng.exe	58
PID 1320 wrote to memory of 364	1320	taskeng.exe	58
PID 1320 wrote to memory of 800	1320	taskeng.exe	57
PID 1320 wrote to memory of 800	1320	taskeng.exe	57
PID 1320 wrote to memory of 800	1320	taskeng.exe	57
PID 1320 wrote to memory of 800	1320	taskeng.exe	57
PID 800 wrote to memory of 940	800	sfc.exe	59
PID 800 wrote to memory of 940	800	sfc.exe	59
PID 800 wrote to memory of 940	800	sfc.exe	59
PID 800 wrote to memory of 940	800	sfc.exe	59
PID 800 wrote to memory of 940	800	sfc.exe	59
PID 800 wrote to memory of 940	800	sfc.exe	59
PID 364 wrote to memory of 1180	364	driverquery.exe	60
PID 364 wrote to memory of 1180	364	driverquery.exe	60
PID 364 wrote to memory of 1180	364	driverquery.exe	60
PID 364 wrote to memory of 1180	364	driverquery.exe	60
PID 364 wrote to memory of 1748	364	driverquery.exe	61
PID 364 wrote to memory of 1748	364	driverquery.exe	61
PID 364 wrote to memory of 1748	364	driverquery.exe	61
PID 364 wrote to memory of 1748	364	driverquery.exe	61
PID 364 wrote to memory of 1824	364	driverquery.exe	63
PID 364 wrote to memory of 1824	364	driverquery.exe	63
PID 364 wrote to memory of 1824	364	driverquery.exe	63
PID 364 wrote to memory of 1824	364	driverquery.exe	63
PID 800 wrote to memory of 1604	800	sfc.exe	62
PID 800 wrote to memory of 1604	800	sfc.exe	62
PID 800 wrote to memory of 1604	800	sfc.exe	62
PID 800 wrote to memory of 1604	800	sfc.exe	62
PID 364 wrote to memory of 2012	364	driverquery.exe	64
PID 364 wrote to memory of 2012	364	driverquery.exe	64
PID 364 wrote to memory of 2012	364	driverquery.exe	64
PID 364 wrote to memory of 2012	364	driverquery.exe	64
PID 364 wrote to memory of 1608	364	driverquery.exe	66
PID 364 wrote to memory of 1608	364	driverquery.exe	66
PID 364 wrote to memory of 1608	364	driverquery.exe	66
PID 364 wrote to memory of 1608	364	driverquery.exe	66
PID 364 wrote to memory of 1612	364	driverquery.exe	67
PID 364 wrote to memory of 1612	364	driverquery.exe	67
PID 364 wrote to memory of 1612	364	driverquery.exe	67
PID 364 wrote to memory of 1612	364	driverquery.exe	67
PID 364 wrote to memory of 1296	364	driverquery.exe	68
PID 364 wrote to memory of 1296	364	driverquery.exe	68
PID 364 wrote to memory of 1296	364	driverquery.exe	68
PID 364 wrote to memory of 1296	364	driverquery.exe	68

C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
"C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe
  "C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe
    "C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:664
      - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:640
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:316
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:1168
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:1532
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\medical-application-form.pdf"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"
  2⤵
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"
  2⤵
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"
  2⤵
  PID:904
- C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"
  2⤵
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"
  2⤵
  PID:2016
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1152

C:\Windows\system32\taskeng.exe
taskeng.exe {86428613-8EB0-433C-8EE1-9588190C7995} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
PID:1320
- C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
  C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:800
- - C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
    "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
    3⤵
    - Executes dropped EXE
    PID:940
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:1604
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  2⤵
  - Executes dropped EXE
  PID:364
- - C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
    "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
    3⤵
    - Executes dropped EXE
    PID:1180
- - C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
    "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
    "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
    3⤵
    - Executes dropped EXE
    PID:1824
- - C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
    "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
    3⤵
    - Executes dropped EXE
    PID:2012
- - C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
    "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
    3⤵
    - Executes dropped EXE
    PID:1608
- - C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
    "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
    3⤵
    - Executes dropped EXE
    PID:1612
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/460-71-0x00000000000C0000-0x00000000000E0000-memory.dmp

Download

memory/952-30-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/952-27-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/1336-18-0x00000000027C0000-0x00000000027C4000-memory.dmp

Download

memory/1680-36-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/1704-10-0x0000000000080000-0x00000000000A0000-memory.dmp

Download

memory/1996-33-0x0000000000400000-0x0000000000526000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads