remcos | d9c227ed57ca134b518a38f74580faf7f3c5e05c5caae3ed3166641341950ee7

Analysis

max time kernel
150s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
26-04-2021 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
Size

260KB
MD5

84bc6ece04588d297e5f957f8c0eed1a
SHA1

47b0cfaaef2a8dceeb377e822094fd8a97b6fc0b
SHA256

d9c227ed57ca134b518a38f74580faf7f3c5e05c5caae3ed3166641341950ee7
SHA512

83c546bebebe502a4239c18e29230dec4a3df29568ff97cec6b64fa00801b2572ee738b0f74d9a11f693fff34f6b23db8edbfc16a4b5baa1482ff604314600f1

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

188.72.124.143:2858

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs

Processes:

TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr

pid	process
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr

Suspicious use of SetThreadContext 64 IoCs

Processes:

TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scrapplaunch.exe

description	pid	process	target process
PID 2116 set thread context of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 1004 set thread context of 3548	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 848	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4060	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 940	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2624	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3396	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3824	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2736	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3460	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2948	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2616	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 432	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4028	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2136	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3736	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2276	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2240	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 1000	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3168	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3004	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4084	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2288	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2776	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3404	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2148	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2472	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3780	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2828	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3720	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4044	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 692	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3732	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2752	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3508	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2220	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3356	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 1200	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3748	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4088	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 856	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3952	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2184	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 652	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 1296	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 1304	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 2756	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4052	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3932	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 1212	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 3972	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 1772	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 504	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4120	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4148	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4176	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4204	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4236	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4260	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4292	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4316	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4340	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4368	1004	applaunch.exe	svchost.exe
PID 1004 set thread context of 4388	1004	applaunch.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1856 2116 WerFault.exe TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1464 timeout.exe

pid	pid_target	process	target process
1856	2116	WerFault.exe	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr

pid	process
1464	timeout.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scrWerFault.exe

pid	process
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scrWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
Token: SeRestorePrivilege	1856	WerFault.exe
Token: SeBackupPrivilege	1856	WerFault.exe
Token: SeDebugPrivilege	1856	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scrcmd.exeapplaunch.exe

description	pid	process	target process
PID 2116 wrote to memory of 3752	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	cmd.exe
PID 2116 wrote to memory of 3752	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	cmd.exe
PID 2116 wrote to memory of 3752	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	cmd.exe
PID 3752 wrote to memory of 1464	3752	cmd.exe	timeout.exe
PID 3752 wrote to memory of 1464	3752	cmd.exe	timeout.exe
PID 3752 wrote to memory of 1464	3752	cmd.exe	timeout.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 2116 wrote to memory of 1004	2116	TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr	applaunch.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3548	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3764	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3764	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3764	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 848	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 4060	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3840	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3840	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 3840	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe
PID 1004 wrote to memory of 940	1004	applaunch.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr
"C:\Users\Admin\AppData\Local\Temp\TPE-CHESTERFIELD, MI 48051 (DDP)駿得5008.scr" /S
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3548

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:848

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4060

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3840

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:940

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2040

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2624

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3396

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2908

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3824

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3532

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2736

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3460

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2948

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3668

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2616

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:432

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4028

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2136

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3736

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2304

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2276

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2240

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1000

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4024

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3168

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4084

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2288

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2776

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3404

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2148

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3780

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2828

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2968

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3176

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3768

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3720

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4044

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:692

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3732

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2752

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3760

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3508

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2220

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3356

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1200

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4088

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:856

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3952

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3784

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2184

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:416

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:652

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2088

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1296

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:512

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3120

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1304

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1168

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:188

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3036

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1796

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:2756

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4052

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3932

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1212

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:3972

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1216

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1772

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:504

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4120

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4148

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4176

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4204

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4236

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4260

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4284

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4292

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4316

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4340

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4368

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4388

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4404

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4420

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4436

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4456

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4476

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4492

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4516

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4532

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1884
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-162-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/432-161-0x000000000040F2B0-mapping.dmp

Download
memory/504-282-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/504-281-0x000000000040F2B0-mapping.dmp

Download
memory/652-255-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/652-254-0x000000000040F2B0-mapping.dmp

Download
memory/692-218-0x000000000040F2B0-mapping.dmp

Download
memory/692-219-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/848-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/848-131-0x000000000040F2B0-mapping.dmp

Download
memory/856-246-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/856-245-0x000000000040F2B0-mapping.dmp

Download
memory/940-138-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/940-137-0x000000000040F2B0-mapping.dmp

Download
memory/1000-180-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1000-179-0x000000000040F2B0-mapping.dmp

Download
memory/1004-128-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1004-122-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1004-123-0x000000000042EEEF-mapping.dmp

Download
memory/1200-237-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1200-236-0x000000000040F2B0-mapping.dmp

Download
memory/1212-272-0x000000000040F2B0-mapping.dmp

Download
memory/1212-273-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1296-257-0x000000000040F2B0-mapping.dmp

Download
memory/1296-258-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1304-260-0x000000000040F2B0-mapping.dmp

Download
memory/1304-261-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1464-121-0x0000000000000000-mapping.dmp

Download
memory/1772-279-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1772-278-0x000000000040F2B0-mapping.dmp

Download
memory/2116-118-0x0000000004C40000-0x000000000513E000-memory.dmp

Filesize
5.0MB

Download
memory/2116-119-0x00000000025D0000-0x0000000002650000-memory.dmp

Filesize
512KB

Download
memory/2116-117-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/2116-114-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/2116-116-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/2136-167-0x000000000040F2B0-mapping.dmp

Download
memory/2136-168-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2148-200-0x000000000040F2B0-mapping.dmp

Download
memory/2148-201-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2184-252-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2184-251-0x000000000040F2B0-mapping.dmp

Download
memory/2220-231-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2220-230-0x000000000040F2B0-mapping.dmp

Download
memory/2240-176-0x000000000040F2B0-mapping.dmp

Download
memory/2240-177-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2276-174-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2276-173-0x000000000040F2B0-mapping.dmp

Download
memory/2288-191-0x000000000040F2B0-mapping.dmp

Download
memory/2288-192-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2472-204-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2472-203-0x000000000040F2B0-mapping.dmp

Download
memory/2616-159-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2616-158-0x000000000040F2B0-mapping.dmp

Download
memory/2624-140-0x000000000040F2B0-mapping.dmp

Download
memory/2624-141-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2736-149-0x000000000040F2B0-mapping.dmp

Download
memory/2736-150-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2752-225-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2752-224-0x000000000040F2B0-mapping.dmp

Download
memory/2756-263-0x000000000040F2B0-mapping.dmp

Download
memory/2756-264-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2776-194-0x000000000040F2B0-mapping.dmp

Download
memory/2776-195-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2828-209-0x000000000040F2B0-mapping.dmp

Download
memory/2828-210-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2948-155-0x000000000040F2B0-mapping.dmp

Download
memory/2948-156-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3004-185-0x000000000040F2B0-mapping.dmp

Download
memory/3004-186-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3168-183-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3168-182-0x000000000040F2B0-mapping.dmp

Download
memory/3356-233-0x000000000040F2B0-mapping.dmp

Download
memory/3356-234-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3396-143-0x000000000040F2B0-mapping.dmp

Download
memory/3396-144-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3404-198-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3404-197-0x000000000040F2B0-mapping.dmp

Download
memory/3460-153-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3460-152-0x000000000040F2B0-mapping.dmp

Download
memory/3508-227-0x000000000040F2B0-mapping.dmp

Download
memory/3508-228-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3548-126-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3548-129-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3548-127-0x000000000040F2B0-mapping.dmp

Download
memory/3720-212-0x000000000040F2B0-mapping.dmp

Download
memory/3720-213-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3732-222-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3732-221-0x000000000040F2B0-mapping.dmp

Download
memory/3736-170-0x000000000040F2B0-mapping.dmp

Download
memory/3736-171-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3748-239-0x000000000040F2B0-mapping.dmp

Download
memory/3748-240-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3752-120-0x0000000000000000-mapping.dmp

Download
memory/3780-206-0x000000000040F2B0-mapping.dmp

Download
memory/3780-207-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3824-147-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3824-146-0x000000000040F2B0-mapping.dmp

Download
memory/3932-269-0x000000000040F2B0-mapping.dmp

Download
memory/3932-270-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3952-249-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3952-248-0x000000000040F2B0-mapping.dmp

Download
memory/3972-275-0x000000000040F2B0-mapping.dmp

Download
memory/3972-276-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4028-164-0x000000000040F2B0-mapping.dmp

Download
memory/4028-165-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4044-215-0x000000000040F2B0-mapping.dmp

Download
memory/4044-216-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4052-267-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4052-266-0x000000000040F2B0-mapping.dmp

Download
memory/4060-135-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4060-134-0x000000000040F2B0-mapping.dmp

Download
memory/4084-188-0x000000000040F2B0-mapping.dmp

Download
memory/4084-189-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4088-243-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4088-242-0x000000000040F2B0-mapping.dmp

Download
memory/4120-284-0x000000000040F2B0-mapping.dmp

Download
memory/4120-285-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4148-287-0x000000000040F2B0-mapping.dmp

Download
memory/4148-288-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4176-290-0x000000000040F2B0-mapping.dmp

Download
memory/4176-291-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4204-294-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4204-293-0x000000000040F2B0-mapping.dmp

Download
memory/4236-295-0x000000000040F2B0-mapping.dmp

Download
memory/4236-296-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4260-297-0x000000000040F2B0-mapping.dmp

Download
memory/4260-298-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4292-299-0x000000000040F2B0-mapping.dmp

Download
memory/4292-300-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4316-301-0x000000000040F2B0-mapping.dmp

Download
memory/4316-302-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4340-303-0x000000000040F2B0-mapping.dmp

Download
memory/4340-304-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4368-305-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download