remcos | 3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6

Analysis

max time kernel
150s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe
Size 2.9MB
Sample201109-lsvwv9mtbn
SHA256 3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6
MD5 8bcd31a740bed11615716badd245c43c
SHA1 a1679e88e02c7d7f3856470eb5445a5f4694e884
SHA512 d5bbae77c2cf7d3d9dd4852056d93b64724d1e93f817d9410257d35c30460f81d0262e00a10d7eb52c56843061567a4bc616cabe7388fda3ab38425eff144941
MD5 SHA1 SHA512

Score

10^/10

remcos link pdf persistence rat upx

Malware Config

Extracted

Family

remcos

daya4659.ddns.net:8282

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3132 created 2868	3132	WerFault.exe	89

Executes dropped EXE 16 IoCs

pid	Process
2472	remcos_agent_Protected.exe
3724	remcos_agent_Protected.exe
2832	remcos.exe
4052	remcos.exe
4552	sfc.exe
4620	driverquery.exe
4796	driverquery.exe
4916	sfc.exe
4120	driverquery.exe
4164	driverquery.exe
4140	sfc.exe
4288	sfc.exe
4452	driverquery.exe
4636	sfc.exe
4560	driverquery.exe
4768	sfc.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2664-4-0x0000000000400000-0x00000000004C0000-memory.dmp	upx

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-8eb2 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-8eb2.exe뤀"	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos_agent_Protected.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos_agent_Protected.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos_agent_Protected.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos_agent_Protected.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 4048 set thread context of 2664	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	78
PID 2472 set thread context of 3724	2472	remcos_agent_Protected.exe	81
PID 2832 set thread context of 4052	2832	remcos.exe	88
PID 4052 set thread context of 2868	4052	remcos.exe	89
PID 4620 set thread context of 4796	4620	driverquery.exe	104
PID 4552 set thread context of 4916	4552	sfc.exe	107
PID 4120 set thread context of 4164	4120	driverquery.exe	114
PID 4140 set thread context of 4288	4140	sfc.exe	118
PID 4452 set thread context of 4560	4452	driverquery.exe	123
PID 4636 set thread context of 4768	4636	sfc.exe	126

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

HTTP links in PDF interactive object 8 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral2/files/0x000100000001ab48-13.dat	pdf_with_link_action
behavioral2/files/0x000100000001ab4a-106.dat	pdf_with_link_action
behavioral2/files/0x000100000001ab4a-107.dat	pdf_with_link_action
behavioral2/files/0x000100000001ab4a-113.dat	pdf_with_link_action
behavioral2/files/0x000100000001ab4a-119.dat	pdf_with_link_action
behavioral2/files/0x000100000001ab4a-123.dat	pdf_with_link_action
behavioral2/files/0x000100000001ab4a-130.dat	pdf_with_link_action
behavioral2/files/0x000100000001ab4a-135.dat	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3132	2868	WerFault.exe	89

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4508	schtasks.exe
4576	schtasks.exe
3636	schtasks.exe
2648	schtasks.exe
4964	schtasks.exe
4656	schtasks.exe
204	schtasks.exe
4852	schtasks.exe
4236	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	remcos_agent_Protected.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
3132	WerFault.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4052	remcos.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2664	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3132	WerFault.exe
Token: SeBackupPrivilege	3132	WerFault.exe
Token: SeBackupPrivilege	3132	WerFault.exe
Token: SeDebugPrivilege	3132	WerFault.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe
4052	remcos.exe
2576	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2472	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	75
PID 4048 wrote to memory of 2472	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	75
PID 4048 wrote to memory of 2472	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	75
PID 4048 wrote to memory of 2576	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	77
PID 4048 wrote to memory of 2576	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	77
PID 4048 wrote to memory of 2576	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	77
PID 4048 wrote to memory of 2664	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	78
PID 4048 wrote to memory of 2664	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	78
PID 4048 wrote to memory of 2664	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	78
PID 4048 wrote to memory of 2664	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	78
PID 4048 wrote to memory of 2664	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	78
PID 4048 wrote to memory of 204	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	79
PID 4048 wrote to memory of 204	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	79
PID 4048 wrote to memory of 204	4048	3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe	79
PID 2472 wrote to memory of 3724	2472	remcos_agent_Protected.exe	81
PID 2472 wrote to memory of 3724	2472	remcos_agent_Protected.exe	81
PID 2472 wrote to memory of 3724	2472	remcos_agent_Protected.exe	81
PID 2472 wrote to memory of 3724	2472	remcos_agent_Protected.exe	81
PID 2472 wrote to memory of 3724	2472	remcos_agent_Protected.exe	81
PID 3724 wrote to memory of 1176	3724	remcos_agent_Protected.exe	82
PID 3724 wrote to memory of 1176	3724	remcos_agent_Protected.exe	82
PID 3724 wrote to memory of 1176	3724	remcos_agent_Protected.exe	82
PID 2472 wrote to memory of 3636	2472	remcos_agent_Protected.exe	83
PID 2472 wrote to memory of 3636	2472	remcos_agent_Protected.exe	83
PID 2472 wrote to memory of 3636	2472	remcos_agent_Protected.exe	83
PID 1176 wrote to memory of 1500	1176	WScript.exe	85
PID 1176 wrote to memory of 1500	1176	WScript.exe	85
PID 1176 wrote to memory of 1500	1176	WScript.exe	85
PID 1500 wrote to memory of 2832	1500	cmd.exe	87
PID 1500 wrote to memory of 2832	1500	cmd.exe	87
PID 1500 wrote to memory of 2832	1500	cmd.exe	87
PID 2832 wrote to memory of 4052	2832	remcos.exe	88
PID 2832 wrote to memory of 4052	2832	remcos.exe	88
PID 2832 wrote to memory of 4052	2832	remcos.exe	88
PID 2832 wrote to memory of 4052	2832	remcos.exe	88
PID 2832 wrote to memory of 4052	2832	remcos.exe	88
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 4052 wrote to memory of 2868	4052	remcos.exe	89
PID 2832 wrote to memory of 2648	2832	remcos.exe	92
PID 2832 wrote to memory of 2648	2832	remcos.exe	92
PID 2832 wrote to memory of 2648	2832	remcos.exe	92
PID 2576 wrote to memory of 4076	2576	AcroRd32.exe	94
PID 2576 wrote to memory of 4076	2576	AcroRd32.exe	94
PID 2576 wrote to memory of 4076	2576	AcroRd32.exe	94
PID 2576 wrote to memory of 3744	2576	AcroRd32.exe	95
PID 2576 wrote to memory of 3744	2576	AcroRd32.exe	95
PID 2576 wrote to memory of 3744	2576	AcroRd32.exe	95
PID 4076 wrote to memory of 3964	4076	RdrCEF.exe	96
PID 4076 wrote to memory of 3964	4076	RdrCEF.exe	96
PID 4076 wrote to memory of 3964	4076	RdrCEF.exe	96
PID 4076 wrote to memory of 3964	4076	RdrCEF.exe	96
PID 4076 wrote to memory of 3964	4076	RdrCEF.exe	96
PID 4076 wrote to memory of 3964	4076	RdrCEF.exe	96
PID 4076 wrote to memory of 3964	4076	RdrCEF.exe	96
PID 4076 wrote to memory of 3964	4076	RdrCEF.exe	96
PID 4076 wrote to memory of 3964	4076	RdrCEF.exe	96

C:\Users\Admin\AppData\Local\Temp\3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe
"C:\Users\Admin\AppData\Local\Temp\3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe
  "C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe
    "C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1500
      - C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        8⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 584
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Drops file in Windows directory
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3132
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:2648
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:3636
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\medical-application-form.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=85206E97A9B92B1E512E6A70A7DFF6FB --mojo-platform-channel-handle=1644 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5DE9484ADAD2FF32F96FAE9907807040 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5DE9484ADAD2FF32F96FAE9907807040 --renderer-client-id=2 --mojo-platform-channel-handle=1660 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=63725B5A042E7270416569C124544E22 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=63725B5A042E7270416569C124544E22 --renderer-client-id=4 --mojo-platform-channel-handle=2084 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=37A97F8286FEB672352E8C7B12632399 --mojo-platform-channel-handle=2488 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D84FB4B0D7FA0B70A66C5B4C66610D03 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6ABBB8F1F6172558EEBEF5093D60D30E --mojo-platform-channel-handle=2592 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4680
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:3744
- C:\Users\Admin\AppData\Local\Temp\3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe
  "C:\Users\Admin\AppData\Local\Temp\3528262d84ec15b8f88df39fe817d32a773274d53541ceee13c983c81b15fcf6.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: RenamesItself
  PID:2664
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:204

C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4552
- C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
  "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4964

C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4620
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4852

C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4120
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4236

C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4140
- C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
  "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4508

C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4452
- C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe
  "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4576

C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4636
- C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe
  "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-4-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/2868-21-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/2868-23-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/3132-87-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-77-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-49-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-50-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-52-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-51-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-54-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-55-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-56-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-57-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-58-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-40-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download

memory/3132-59-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-60-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-61-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-62-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-63-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-64-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-65-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-66-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-67-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-41-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-70-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-25-0x00000000043B0000-0x00000000043B1000-memory.dmp

Download

memory/3132-68-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-43-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-72-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-44-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-94-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-75-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-78-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-81-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-82-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-84-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-31-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/3132-39-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-89-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-90-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-48-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-91-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-42-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-85-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-96-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-45-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-46-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3132-47-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/3724-7-0x0000000000170000-0x0000000000190000-memory.dmp

Download

memory/3964-69-0x0000000077652000-0x000000007765200C-memory.dmp

Download

memory/4052-18-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4104-73-0x0000000077652000-0x000000007765200C-memory.dmp

Download

memory/4200-86-0x0000000077652000-0x000000007765200C-memory.dmp

Download

memory/4420-98-0x0000000077652000-0x000000007765200C-memory.dmp

Download

memory/4524-101-0x0000000077652000-0x000000007765200C-memory.dmp

Download

memory/4680-108-0x0000000077652000-0x000000007765200C-memory.dmp

Download

memory/4768-137-0x0000000000100000-0x0000000000120000-memory.dmp

Download

memory/4916-115-0x0000000000120000-0x0000000000140000-memory.dmp

Download