Analysis
- max time kernel
149s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:49
Static task
static1
Behavioral task
behavioral1
Sample
fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe
- Size 2.9MB
- Sample201109-ghjpyvdfhs
- SHA256 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463
- MD5 98feed3d432c78a7c6399466aa5c89c2
- SHA1 e1efaa681ddc3314d688d6a2a21186c47faa7cd5
- SHA512 b34c0752a8b6d577f7cfba0ad2a7d48f6ed682a0666c7d8ebaeee0942760676b169105548733de13b28b4dd0b5de243fae28df7779167c2fdb6bb9cc8b3797c1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
daya4659.ddns.net:8282
Signatures
- Executes dropped EXE 18 IoCs
pid Process 1984 remcos_agent_Protected.exe 3160 remcos_agent_Protected.exe 1508 remcos.exe 4500 remcos.exe 4732 driverquery.exe 4756 driverquery.exe 4860 sfc.exe 4908 sfc.exe 5092 sfc.exe 5116 driverquery.exe 1444 driverquery.exe 4136 driverquery.exe 4124 driverquery.exe 4300 sfc.exe 4308 sfc.exe 4348 driverquery.exe 4468 driverquery.exe 3892 sfc.exe -
resource yara_rule behavioral2/memory/2760-4-0x0000000000400000-0x00000000004C0000-memory.dmp upx - Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos_agent_Protected.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos_agent_Protected.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos_agent_Protected.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-7f3b = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-7f3b.exe褀" fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos_agent_Protected.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos.exe - Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 3284 set thread context of 2760 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 78 PID 1984 set thread context of 3160 1984 remcos_agent_Protected.exe 81 PID 1508 set thread context of 4500 1508 remcos.exe 95 PID 4732 set thread context of 4756 4732 driverquery.exe 103 PID 4860 set thread context of 4908 4860 sfc.exe 107 PID 5116 set thread context of 4124 5116 driverquery.exe 114 PID 5092 set thread context of 4300 5092 sfc.exe 117 PID 4348 set thread context of 4468 4348 driverquery.exe 122 PID 4308 set thread context of 3892 4308 sfc.exe 125 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe - Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2196 schtasks.exe 2152 schtasks.exe 1556 schtasks.exe 4420 schtasks.exe 4652 schtasks.exe 4808 schtasks.exe 4956 schtasks.exe 4232 schtasks.exe 4644 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings remcos_agent_Protected.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2760 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 AcroRd32.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 2508 AcroRd32.exe 4500 remcos.exe 2508 AcroRd32.exe - Suspicious use of WriteProcessMemory 349 IoCs
description pid Process procid_target PID 3284 wrote to memory of 1984 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 75 PID 3284 wrote to memory of 1984 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 75 PID 3284 wrote to memory of 1984 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 75 PID 3284 wrote to memory of 2508 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 77 PID 3284 wrote to memory of 2508 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 77 PID 3284 wrote to memory of 2508 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 77 PID 3284 wrote to memory of 2760 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 78 PID 3284 wrote to memory of 2760 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 78 PID 3284 wrote to memory of 2760 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 78 PID 3284 wrote to memory of 2760 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 78 PID 3284 wrote to memory of 2760 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 78 PID 3284 wrote to memory of 2196 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 79 PID 3284 wrote to memory of 2196 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 79 PID 3284 wrote to memory of 2196 3284 fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe 79 PID 1984 wrote to memory of 3160 1984 remcos_agent_Protected.exe 81 PID 1984 wrote to memory of 3160 1984 remcos_agent_Protected.exe 81 PID 1984 wrote to memory of 3160 1984 remcos_agent_Protected.exe 81 PID 1984 wrote to memory of 3160 1984 remcos_agent_Protected.exe 81 PID 1984 wrote to memory of 3160 1984 remcos_agent_Protected.exe 81 PID 3160 wrote to memory of 1552 3160 remcos_agent_Protected.exe 82 PID 3160 wrote to memory of 1552 3160 remcos_agent_Protected.exe 82 PID 3160 wrote to memory of 1552 3160 remcos_agent_Protected.exe 82 PID 1984 wrote to memory of 2152 1984 remcos_agent_Protected.exe 83 PID 1984 wrote to memory of 2152 1984 remcos_agent_Protected.exe 83 PID 1984 wrote to memory of 2152 1984 remcos_agent_Protected.exe 83 PID 1552 wrote to memory of 3828 1552 WScript.exe 85 PID 1552 wrote to memory of 3828 1552 WScript.exe 85 PID 1552 wrote to memory of 3828 1552 WScript.exe 85 PID 3828 wrote to memory of 1508 3828 cmd.exe 87 PID 3828 wrote to memory of 1508 3828 cmd.exe 87 PID 3828 wrote to memory of 1508 3828 cmd.exe 87 PID 2508 wrote to memory of 204 2508 AcroRd32.exe 88 PID 2508 wrote to memory of 204 2508 AcroRd32.exe 88 PID 2508 wrote to memory of 204 2508 AcroRd32.exe 88 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 3644 204 RdrCEF.exe 89 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 900 204 RdrCEF.exe 90 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 896 204 RdrCEF.exe 91 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4192 204 RdrCEF.exe 92 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4284 204 RdrCEF.exe 93 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 204 wrote to memory of 4388 204 RdrCEF.exe 94 PID 1508 wrote to memory of 4500 1508 remcos.exe 95 PID 1508 wrote to memory of 4500 1508 remcos.exe 95 PID 1508 wrote to memory of 4500 1508 remcos.exe 95 PID 1508 wrote to memory of 4500 1508 remcos.exe 95 PID 1508 wrote to memory of 4500 1508 remcos.exe 95 PID 4500 wrote to memory of 4556 4500 remcos.exe 96 PID 4500 wrote to memory of 4556 4500 remcos.exe 96 PID 4500 wrote to memory of 4556 4500 remcos.exe 96 PID 1508 wrote to memory of 4652 1508 remcos.exe 99 PID 1508 wrote to memory of 4652 1508 remcos.exe 99 PID 1508 wrote to memory of 4652 1508 remcos.exe 99 PID 4732 wrote to memory of 4756 4732 driverquery.exe 103 PID 4732 wrote to memory of 4756 4732 driverquery.exe 103 PID 4732 wrote to memory of 4756 4732 driverquery.exe 103 PID 4732 wrote to memory of 4756 4732 driverquery.exe 103 PID 4732 wrote to memory of 4756 4732 driverquery.exe 103 PID 4732 wrote to memory of 4808 4732 driverquery.exe 104 PID 4732 wrote to memory of 4808 4732 driverquery.exe 104 PID 4732 wrote to memory of 4808 4732 driverquery.exe 104 PID 4860 wrote to memory of 4908 4860 sfc.exe 107 PID 4860 wrote to memory of 4908 4860 sfc.exe 107 PID 4860 wrote to memory of 4908 4860 sfc.exe 107 PID 4860 wrote to memory of 4908 4860 sfc.exe 107 PID 4860 wrote to memory of 4908 4860 sfc.exe 107 PID 4860 wrote to memory of 4956 4860 sfc.exe 108 PID 4860 wrote to memory of 4956 4860 sfc.exe 108 PID 4860 wrote to memory of 4956 4860 sfc.exe 108 PID 5116 wrote to memory of 1444 5116 driverquery.exe 112 PID 5116 wrote to memory of 1444 5116 driverquery.exe 112 PID 5116 wrote to memory of 1444 5116 driverquery.exe 112 PID 5116 wrote to memory of 4136 5116 driverquery.exe 113 PID 5116 wrote to memory of 4136 5116 driverquery.exe 113 PID 5116 wrote to memory of 4136 5116 driverquery.exe 113 PID 5116 wrote to memory of 4124 5116 driverquery.exe 114 PID 5116 wrote to memory of 4124 5116 driverquery.exe 114 PID 5116 wrote to memory of 4124 5116 driverquery.exe 114 PID 5116 wrote to memory of 4124 5116 driverquery.exe 114 PID 5116 wrote to memory of 4124 5116 driverquery.exe 114 PID 5116 wrote to memory of 1556 5116 driverquery.exe 115 PID 5116 wrote to memory of 1556 5116 driverquery.exe 115 PID 5116 wrote to memory of 1556 5116 driverquery.exe 115 PID 5092 wrote to memory of 4300 5092 sfc.exe 117 PID 5092 wrote to memory of 4300 5092 sfc.exe 117 PID 5092 wrote to memory of 4300 5092 sfc.exe 117 PID 5092 wrote to memory of 4300 5092 sfc.exe 117 PID 5092 wrote to memory of 4300 5092 sfc.exe 117 PID 5092 wrote to memory of 4232 5092 sfc.exe 118 PID 5092 wrote to memory of 4232 5092 sfc.exe 118 PID 5092 wrote to memory of 4232 5092 sfc.exe 118 PID 4348 wrote to memory of 4468 4348 driverquery.exe 122 PID 4348 wrote to memory of 4468 4348 driverquery.exe 122 PID 4348 wrote to memory of 4468 4348 driverquery.exe 122 PID 4348 wrote to memory of 4468 4348 driverquery.exe 122 PID 4348 wrote to memory of 4468 4348 driverquery.exe 122 PID 4348 wrote to memory of 4420 4348 driverquery.exe 123 PID 4348 wrote to memory of 4420 4348 driverquery.exe 123 PID 4348 wrote to memory of 4420 4348 driverquery.exe 123 PID 4308 wrote to memory of 3892 4308 sfc.exe 125 PID 4308 wrote to memory of 3892 4308 sfc.exe 125 PID 4308 wrote to memory of 3892 4308 sfc.exe 125 PID 4308 wrote to memory of 3892 4308 sfc.exe 125 PID 4308 wrote to memory of 3892 4308 sfc.exe 125 PID 4308 wrote to memory of 4644 4308 sfc.exe 126 PID 4308 wrote to memory of 4644 4308 sfc.exe 126 PID 4308 wrote to memory of 4644 4308 sfc.exe 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exeC:\Users\Admin\AppData\Roaming\remcos\remcos.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1508 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4500 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4556
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F7⤵
- Creates scheduled task(s)
PID:4652
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2152
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\medical-application-form.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C6EE2CDE19587D75AC280717E05EEDCA --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3644
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1D6ACAE296D2846CE0F1A48A2F77C7E9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1D6ACAE296D2846CE0F1A48A2F77C7E9 --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:14⤵PID:900
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=817877C64057BA4D0C5ED7F8E0FE4501 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=817877C64057BA4D0C5ED7F8E0FE4501 --renderer-client-id=4 --mojo-platform-channel-handle=2096 --allow-no-sandbox-job /prefetch:14⤵PID:896
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CB748876317031E3745BBE5017D1FA9A --mojo-platform-channel-handle=2464 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4192
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3F7423E0D6F2DF4A9DE5B9407495DFE3 --mojo-platform-channel-handle=2484 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4284
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B5FBB457C45CE67C87FE978C3E69881D --mojo-platform-channel-handle=2548 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:4388
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"C:\Users\Admin\AppData\Local\Temp\fdbf2db23a47bf68de9535195e4dcdd74cf899b9cb04937650aa246859a65463.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:2760
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2196
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exeC:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4732 -
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
PID:4756
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4808
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4860 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:4908
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4956
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5092 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:4300
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4232
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exeC:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5116 -
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
PID:1444
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
PID:4136
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
PID:4124
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1556
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4308 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:3892
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4644
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exeC:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4348 -
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
PID:4468
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4420
-