njrat | 9bb347dce075e62a7df2121b6f413769b564e0b58d4302a2372bedeac6a2880b

Analysis

max time kernel
142s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Remcos 1.7 Full version Cracked.exe
Size

13.2MB
MD5

c00c09e7fa52bc19bd425d71e78ff4cb
SHA1

2cd1a7130a03d4056454733b62e4667a08451262
SHA256

9bb347dce075e62a7df2121b6f413769b564e0b58d4302a2372bedeac6a2880b
SHA512

8d18238fe7c906ddd155b8af3a0d32604aeafaf352ab1947a07f273168740c5971083b157c7e21b74125a7e42d8684db5daba2cb3bc4971ca92f20949828a9d5
SSDEEP

49152:LLxWP/6L37yMNw9R9ZG2ca1ZHk5lPkSMc/iZCFlM/B74CEpTQozIENbVQDVdI+0V:9

Score

10^/10

njrat system persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

System

2.tcp.ngrok.io:13817

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

paylod.exeremcos.exeSystem.exe

pid process

976 paylod.exe
1700 remcos.exe
852 System.exe

pid	process
976	paylod.exe
1700	remcos.exe
852	System.exe

Drops startup file 2 IoCs

Processes:

paylod.exeSystem.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	paylod.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	System.exe

Loads dropped DLL 5 IoCs

Processes:

Remcos 1.7 Full version Cracked.exepaylod.exe

pid	process
1812	Remcos 1.7 Full version Cracked.exe
1812	Remcos 1.7 Full version Cracked.exe
1812	Remcos 1.7 Full version Cracked.exe
976	paylod.exe
976	paylod.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

System.exepaylod.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	System.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\ProgramData\\System.exe"	paylod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	System.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	System.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

remcos.exe

pid process

1700 remcos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

remcos.exechrome.exechrome.exe

pid process

1700 remcos.exe
1700 remcos.exe
1720 chrome.exe
1300 chrome.exe
1300 chrome.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

System.exe

description	pid	process
Token: SeDebugPrivilege	852	System.exe
Token: 33	852	System.exe
Token: SeIncBasePriorityPrivilege	852	System.exe
Token: 33	852	System.exe
Token: SeIncBasePriorityPrivilege	852	System.exe
Token: 33	852	System.exe
Token: SeIncBasePriorityPrivilege	852	System.exe
Token: 33	852	System.exe
Token: SeIncBasePriorityPrivilege	852	System.exe
Token: 33	852	System.exe
Token: SeIncBasePriorityPrivilege	852	System.exe
Token: 33	852	System.exe
Token: SeIncBasePriorityPrivilege	852	System.exe
Token: 33	852	System.exe
Token: SeIncBasePriorityPrivilege	852	System.exe
Token: 33	852	System.exe
Token: SeIncBasePriorityPrivilege	852	System.exe

Suspicious use of FindShellTrayWindow 51 IoCs

Processes:

remcos.exechrome.exe

pid	process
1700	remcos.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe

Suspicious use of SendNotifyMessage 49 IoCs

Processes:

remcos.exechrome.exe

pid	process
1700	remcos.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

remcos.exe

pid process

1700 remcos.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Remcos 1.7 Full version Cracked.exepaylod.exechrome.exe

description	pid	process	target process
PID 1812 wrote to memory of 976	1812	Remcos 1.7 Full version Cracked.exe	paylod.exe
PID 1812 wrote to memory of 976	1812	Remcos 1.7 Full version Cracked.exe	paylod.exe
PID 1812 wrote to memory of 976	1812	Remcos 1.7 Full version Cracked.exe	paylod.exe
PID 1812 wrote to memory of 976	1812	Remcos 1.7 Full version Cracked.exe	paylod.exe
PID 1812 wrote to memory of 1700	1812	Remcos 1.7 Full version Cracked.exe	remcos.exe
PID 1812 wrote to memory of 1700	1812	Remcos 1.7 Full version Cracked.exe	remcos.exe
PID 1812 wrote to memory of 1700	1812	Remcos 1.7 Full version Cracked.exe	remcos.exe
PID 1812 wrote to memory of 1700	1812	Remcos 1.7 Full version Cracked.exe	remcos.exe
PID 976 wrote to memory of 852	976	paylod.exe	System.exe
PID 976 wrote to memory of 852	976	paylod.exe	System.exe
PID 976 wrote to memory of 852	976	paylod.exe	System.exe
PID 976 wrote to memory of 852	976	paylod.exe	System.exe
PID 976 wrote to memory of 1912	976	paylod.exe	attrib.exe
PID 976 wrote to memory of 1912	976	paylod.exe	attrib.exe
PID 976 wrote to memory of 1912	976	paylod.exe	attrib.exe
PID 976 wrote to memory of 1912	976	paylod.exe	attrib.exe
PID 1300 wrote to memory of 1960	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1960	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1960	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1616	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1720	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1720	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1720	1300	chrome.exe	chrome.exe
PID 1300 wrote to memory of 1084	1300	chrome.exe	chrome.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1912 attrib.exe

pid	process
1912	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Remcos 1.7 Full version Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Remcos 1.7 Full version Cracked.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812

C:\Users\Admin\AppData\Local\Temp\paylod.exe
"C:\Users\Admin\AppData\Local\Temp\paylod.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:976

C:\ProgramData\System.exe
"C:\ProgramData\System.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\ProgramData\System.exe"
3⤵
- Views/modifies file attributes
PID:1912

C:\Users\Admin\AppData\Local\Temp\remcos.exe
"C:\Users\Admin\AppData\Local\Temp\remcos.exe"
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66f4f50,0x7fef66f4f60,0x7fef66f4f70
2⤵
PID:1960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1108 /prefetch:2
2⤵
PID:1616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1248 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1744 /prefetch:8
2⤵
PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1
2⤵
PID:1344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
2⤵
PID:616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
2⤵
PID:2124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3308 /prefetch:2
2⤵
PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:2236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3480 /prefetch:8
2⤵
PID:2300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3632 /prefetch:8
2⤵
PID:2308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=908 /prefetch:8
2⤵
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=976 /prefetch:8
2⤵
PID:2444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1824 /prefetch:8
2⤵
PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 /prefetch:8
2⤵
PID:2460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1304 /prefetch:8
2⤵
PID:2468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3916 /prefetch:8
2⤵
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:8
2⤵
PID:2656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:8
2⤵
PID:2664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4120 /prefetch:8
2⤵
PID:2728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:8
2⤵
PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4108 /prefetch:8
2⤵
PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=532 /prefetch:8
2⤵
PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1080,8120705358473663112,1860227969032913649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3248 /prefetch:8
2⤵
PID:2932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\System.exe
Filesize
26KB

MD5
24bf1ae1d62be5e1283fc4ddc9110dd9

SHA1
7b60b080982e77eb4565dce877236297280fcf36

SHA256
55cc06f563e305e118f8d9d6307e88de5f802cd36f6bdf394e17b95bf852bd69

SHA512
b0b1228c90ac6f795c3ee641c94045023cfc8fea0dba82c37c382cc91376c3b03ca0900c82881d9c8d99363a4fdeca4e8bc758c47730444195d0c52703bef391

Download Submit
C:\ProgramData\System.exe
Filesize
26KB

MD5
24bf1ae1d62be5e1283fc4ddc9110dd9

SHA1
7b60b080982e77eb4565dce877236297280fcf36

SHA256
55cc06f563e305e118f8d9d6307e88de5f802cd36f6bdf394e17b95bf852bd69

SHA512
b0b1228c90ac6f795c3ee641c94045023cfc8fea0dba82c37c382cc91376c3b03ca0900c82881d9c8d99363a4fdeca4e8bc758c47730444195d0c52703bef391

Download Submit
C:\Users\Admin\AppData\Local\Temp\paylod.exe
Filesize
26KB

MD5
24bf1ae1d62be5e1283fc4ddc9110dd9

SHA1
7b60b080982e77eb4565dce877236297280fcf36

SHA256
55cc06f563e305e118f8d9d6307e88de5f802cd36f6bdf394e17b95bf852bd69

SHA512
b0b1228c90ac6f795c3ee641c94045023cfc8fea0dba82c37c382cc91376c3b03ca0900c82881d9c8d99363a4fdeca4e8bc758c47730444195d0c52703bef391

Download Submit
C:\Users\Admin\AppData\Local\Temp\paylod.exe
Filesize
26KB

MD5
24bf1ae1d62be5e1283fc4ddc9110dd9

SHA1
7b60b080982e77eb4565dce877236297280fcf36

SHA256
55cc06f563e305e118f8d9d6307e88de5f802cd36f6bdf394e17b95bf852bd69

SHA512
b0b1228c90ac6f795c3ee641c94045023cfc8fea0dba82c37c382cc91376c3b03ca0900c82881d9c8d99363a4fdeca4e8bc758c47730444195d0c52703bef391

Download Submit
C:\Users\Admin\AppData\Local\Temp\remcos.exe
Filesize
9.9MB

MD5
ed1e424ea6f625968a334377e8ac629f

SHA1
ad00cc58a59a3d5b78d6603a1d09378e5dbd1647

SHA256
1e5375b400f68c422804703390489b2cf3968c2a8bccb0b5b3c55fe1d2e3c991

SHA512
5119b6ac8c1becda5b59a4802fc96828d338ba2d2767e5521bc226bf04b6637c1925b0cc1b0cf560540b1399730f695c55de23665e59d0683eb07d32939b8094

Download Submit
C:\Users\Admin\AppData\Local\Temp\remcos.exe
Filesize
9.9MB

MD5
ed1e424ea6f625968a334377e8ac629f

SHA1
ad00cc58a59a3d5b78d6603a1d09378e5dbd1647

SHA256
1e5375b400f68c422804703390489b2cf3968c2a8bccb0b5b3c55fe1d2e3c991

SHA512
5119b6ac8c1becda5b59a4802fc96828d338ba2d2767e5521bc226bf04b6637c1925b0cc1b0cf560540b1399730f695c55de23665e59d0683eb07d32939b8094

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
Filesize
1KB

MD5
f345e1c49c052602fb8b548d39dade03

SHA1
e364dc4b0df7f219d56d1ed451685d5111cedac3

SHA256
71a185003b38f4acfd621c891f97cebdd92620bba7b300de8c66d793b18b0d92

SHA512
ff0e090bdf54a603d4174378b46e76be1a53a8590ed4a787a8f140978588da774602799e916359110a1d48f91bb2cbda0fef1c1b41f4d960feda0e18ecc569a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
Filesize
1018B

MD5
1ad6c4d7d80b5303ae85569d6ccd6afa

SHA1
44ef9137278b1376d80b66d33501cc6cca6e456d

SHA256
867631ca4a0725392ced256f67d5ebaf917e3d7564c7e3189da3b8729dd7fa56

SHA512
d8d8cf943522721133b2fff2392563c3f947241c56edc918d74be92c08444ff2eadbbb23c822d2bc8b5e9999b743bec288aa23f54cab2c770fa50671ee215c03

Download Submit
\??\pipe\crashpad_1300_FYSTGILIUTXCUFBX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\System.exe
Filesize
26KB

MD5
24bf1ae1d62be5e1283fc4ddc9110dd9

SHA1
7b60b080982e77eb4565dce877236297280fcf36

SHA256
55cc06f563e305e118f8d9d6307e88de5f802cd36f6bdf394e17b95bf852bd69

SHA512
b0b1228c90ac6f795c3ee641c94045023cfc8fea0dba82c37c382cc91376c3b03ca0900c82881d9c8d99363a4fdeca4e8bc758c47730444195d0c52703bef391

Download Submit
\ProgramData\System.exe
Filesize
26KB

MD5
24bf1ae1d62be5e1283fc4ddc9110dd9

SHA1
7b60b080982e77eb4565dce877236297280fcf36

SHA256
55cc06f563e305e118f8d9d6307e88de5f802cd36f6bdf394e17b95bf852bd69

SHA512
b0b1228c90ac6f795c3ee641c94045023cfc8fea0dba82c37c382cc91376c3b03ca0900c82881d9c8d99363a4fdeca4e8bc758c47730444195d0c52703bef391

Download Submit
\Users\Admin\AppData\Local\Temp\paylod.exe
Filesize
26KB

MD5
24bf1ae1d62be5e1283fc4ddc9110dd9

SHA1
7b60b080982e77eb4565dce877236297280fcf36

SHA256
55cc06f563e305e118f8d9d6307e88de5f802cd36f6bdf394e17b95bf852bd69

SHA512
b0b1228c90ac6f795c3ee641c94045023cfc8fea0dba82c37c382cc91376c3b03ca0900c82881d9c8d99363a4fdeca4e8bc758c47730444195d0c52703bef391

Download Submit
\Users\Admin\AppData\Local\Temp\paylod.exe
Filesize
26KB

MD5
24bf1ae1d62be5e1283fc4ddc9110dd9

SHA1
7b60b080982e77eb4565dce877236297280fcf36

SHA256
55cc06f563e305e118f8d9d6307e88de5f802cd36f6bdf394e17b95bf852bd69

SHA512
b0b1228c90ac6f795c3ee641c94045023cfc8fea0dba82c37c382cc91376c3b03ca0900c82881d9c8d99363a4fdeca4e8bc758c47730444195d0c52703bef391

Download Submit
\Users\Admin\AppData\Local\Temp\remcos.exe
Filesize
9.9MB

MD5
ed1e424ea6f625968a334377e8ac629f

SHA1
ad00cc58a59a3d5b78d6603a1d09378e5dbd1647

SHA256
1e5375b400f68c422804703390489b2cf3968c2a8bccb0b5b3c55fe1d2e3c991

SHA512
5119b6ac8c1becda5b59a4802fc96828d338ba2d2767e5521bc226bf04b6637c1925b0cc1b0cf560540b1399730f695c55de23665e59d0683eb07d32939b8094

Download Submit
memory/852-84-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download
memory/852-74-0x0000000000000000-mapping.dmp

Download
memory/852-82-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download
memory/976-81-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download
memory/976-67-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download
memory/976-57-0x0000000000000000-mapping.dmp

Download
memory/1700-62-0x0000000000000000-mapping.dmp

Download
memory/1700-71-0x0000000000400000-0x0000000001ABE000-memory.dmp

Filesize
22.7MB

Download
memory/1700-70-0x0000000000400000-0x0000000001ABE000-memory.dmp

Filesize
22.7MB

Download
memory/1700-68-0x0000000000400000-0x0000000001ABE000-memory.dmp

Filesize
22.7MB

Download
memory/1700-83-0x0000000000400000-0x0000000001ABE000-memory.dmp

Filesize
22.7MB

Download
memory/1812-65-0x0000000074970000-0x0000000074F1B000-memory.dmp

Filesize
5.7MB

Download
memory/1812-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1912-78-0x0000000000000000-mapping.dmp

Download