remcos | 0f4d1dbae1cbb430bd201e362d7325a9a462de60d0fa04de4c3ef871de11248d

Analysis

max time kernel
133s
max time network
140s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0936b7713936d51076fe77b8c8da04e0.exe
Size

846KB
MD5

0936b7713936d51076fe77b8c8da04e0
SHA1

110a96f1b5c12fd037d859893a24006f0fa3fd04
SHA256

0f4d1dbae1cbb430bd201e362d7325a9a462de60d0fa04de4c3ef871de11248d
SHA512

03dc8b87e52bde6b2b42ccd763c3c38ad5ffe3d15b3f9df347ffbff083373ed7ca7598698088c80e9559f7e749ab5bf38695ca1163c12ba9ae3a7ed1fc244c62
SSDEEP

12288:8Ho/fOuZ8LRDppurpXjit1hUYr10dBtyyGLosbYE8f4VRn2Ar:wUGuZ8tDCRjizhbrW4pE0pVt

Score

10^/10

remcos oct 25th rdp evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Oct 25th RDP

gcrozonav.duckdns.org:4045

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Microsoft Intel Audio.exe
copy_folder
Audio Microsoft
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Windows Display
keylog_path
%WinDir%
mouse_option
false
mutex
Windows Audio
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Windows Security Check
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
Username;password;proforma;invoice;notepad

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
1516	Microsoft Intel Audio.exe
888	Microsoft Intel Audio.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security Check = "\"C:\\Windows\\Audio Microsoft\\Microsoft Intel Audio.exe\""	Microsoft Intel Audio.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	0936b7713936d51076fe77b8c8da04e0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security Check = "\"C:\\Windows\\Audio Microsoft\\Microsoft Intel Audio.exe\""	0936b7713936d51076fe77b8c8da04e0.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Microsoft Intel Audio.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1660 set thread context of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1516 set thread context of 888	1516	Microsoft Intel Audio.exe	36
PID 888 set thread context of 748	888	Microsoft Intel Audio.exe	40

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Audio Microsoft\Microsoft Intel Audio.exe	0936b7713936d51076fe77b8c8da04e0.exe
File opened for modification	C:\Windows\Audio Microsoft\Microsoft Intel Audio.exe	0936b7713936d51076fe77b8c8da04e0.exe
File opened for modification	C:\Windows\Audio Microsoft	0936b7713936d51076fe77b8c8da04e0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b559aeefe9d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000002a4a4812ebd0b57630cf8e63daa53f71093976f0f703a05833bd39d892e2ede1000000000e80000000020000200000006bc6e8a1582fec180f8bc448e626266fe5b6d784905328d4d0c6416813825d0220000000918d271f41749350a81244f4d1c42a01f1452b21a8110f49a4f65d377b600080400000006f4e605eda4f4b5d5c0115f7e97b18c2bffea7a190ad34732fc98b29539b08238aa3b8a9f8a0a0391931b974b42451646d1b4d4a76a7d2a5a5ac0499a275d208	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4909381-55E2-11ED-8F62-626C2AE6DC56} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000003c1c119d2d6f73f3dc684a294c625be0aa7969b1db763b09f042bcb134b01330000000000e80000000020000200000007b1755f3cba930a3b34d54bad1f7039b435df5710f69893f57a1e72c679ea23f90000000d556150525b3763c99dbb92377a5b1bc64166dde735111ca9c8a94dea2990b6c14afd9714ff479931d9b2a2fe1c96a32199cf631c12d36d07c9ff5675ee602b8343ce241b6199b1ef571b5a0b5c7f5bacd835844a7f4031b3fe3f1b3d3b98babef914e77ab48343f42927a0928a6df32431d6666e8c3b3f0f6a8ba13118e904342a80cb028294ea49d434ae9ea9a44104000000043cc7898760f2e0861cdf0b418df79c707bf981cfa0c60940b449b823d73a5824cd55ae804ffc25570c6858e3e1a4c7d91d961b0d0ec19e12c5f7d9c357ebf26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1868	reg.exe
2016	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
972	PING.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1660 wrote to memory of 1724	1660	0936b7713936d51076fe77b8c8da04e0.exe	28
PID 1724 wrote to memory of 908	1724	0936b7713936d51076fe77b8c8da04e0.exe	29
PID 1724 wrote to memory of 908	1724	0936b7713936d51076fe77b8c8da04e0.exe	29
PID 1724 wrote to memory of 908	1724	0936b7713936d51076fe77b8c8da04e0.exe	29
PID 1724 wrote to memory of 908	1724	0936b7713936d51076fe77b8c8da04e0.exe	29
PID 908 wrote to memory of 1868	908	cmd.exe	31
PID 908 wrote to memory of 1868	908	cmd.exe	31
PID 908 wrote to memory of 1868	908	cmd.exe	31
PID 908 wrote to memory of 1868	908	cmd.exe	31
PID 1724 wrote to memory of 1996	1724	0936b7713936d51076fe77b8c8da04e0.exe	32
PID 1724 wrote to memory of 1996	1724	0936b7713936d51076fe77b8c8da04e0.exe	32
PID 1724 wrote to memory of 1996	1724	0936b7713936d51076fe77b8c8da04e0.exe	32
PID 1724 wrote to memory of 1996	1724	0936b7713936d51076fe77b8c8da04e0.exe	32
PID 1724 wrote to memory of 1996	1724	0936b7713936d51076fe77b8c8da04e0.exe	32
PID 1724 wrote to memory of 1996	1724	0936b7713936d51076fe77b8c8da04e0.exe	32
PID 1724 wrote to memory of 1996	1724	0936b7713936d51076fe77b8c8da04e0.exe	32
PID 1996 wrote to memory of 972	1996	cmd.exe	34
PID 1996 wrote to memory of 972	1996	cmd.exe	34
PID 1996 wrote to memory of 972	1996	cmd.exe	34
PID 1996 wrote to memory of 972	1996	cmd.exe	34
PID 1996 wrote to memory of 1516	1996	cmd.exe	35
PID 1996 wrote to memory of 1516	1996	cmd.exe	35
PID 1996 wrote to memory of 1516	1996	cmd.exe	35
PID 1996 wrote to memory of 1516	1996	cmd.exe	35
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 1516 wrote to memory of 888	1516	Microsoft Intel Audio.exe	36
PID 888 wrote to memory of 1620	888	Microsoft Intel Audio.exe	37
PID 888 wrote to memory of 1620	888	Microsoft Intel Audio.exe	37
PID 888 wrote to memory of 1620	888	Microsoft Intel Audio.exe	37
PID 888 wrote to memory of 1620	888	Microsoft Intel Audio.exe	37
PID 1620 wrote to memory of 2016	1620	cmd.exe	39
PID 1620 wrote to memory of 2016	1620	cmd.exe	39
PID 1620 wrote to memory of 2016	1620	cmd.exe	39
PID 1620 wrote to memory of 2016	1620	cmd.exe	39
PID 888 wrote to memory of 748	888	Microsoft Intel Audio.exe	40
PID 888 wrote to memory of 748	888	Microsoft Intel Audio.exe	40
PID 888 wrote to memory of 748	888	Microsoft Intel Audio.exe	40
PID 888 wrote to memory of 748	888	Microsoft Intel Audio.exe	40
PID 888 wrote to memory of 748	888	Microsoft Intel Audio.exe	40
PID 888 wrote to memory of 748	888	Microsoft Intel Audio.exe	40
PID 888 wrote to memory of 748	888	Microsoft Intel Audio.exe	40
PID 888 wrote to memory of 748	888	Microsoft Intel Audio.exe	40
PID 888 wrote to memory of 748	888	Microsoft Intel Audio.exe	40
PID 748 wrote to memory of 1252	748	iexplore.exe	41
PID 748 wrote to memory of 1252	748	iexplore.exe	41
PID 748 wrote to memory of 1252	748	iexplore.exe	41
PID 748 wrote to memory of 1252	748	iexplore.exe	41

C:\Users\Admin\AppData\Local\Temp\0936b7713936d51076fe77b8c8da04e0.exe
"C:\Users\Admin\AppData\Local\Temp\0936b7713936d51076fe77b8c8da04e0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\0936b7713936d51076fe77b8c8da04e0.exe
  "C:\Users\Admin\AppData\Local\Temp\0936b7713936d51076fe77b8c8da04e0.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:972
  - - C:\Windows\Audio Microsoft\Microsoft Intel Audio.exe
      "C:\Windows\Audio Microsoft\Microsoft Intel Audio.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Windows\Audio Microsoft\Microsoft Intel Audio.exe
        
        "C:\Windows\Audio Microsoft\Microsoft Intel Audio.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:888
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:2016
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
        8⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
103B

MD5
a73a77b757648d9ccd37507cc12c793b

SHA1
01322e04ea4d76d35c37df364d4e48b355451389

SHA256
da4f86914a168dfb5f1dfed83f88501bc23a80b765e41fcedfe9359619cca772

SHA512
ca5998fb251e701e36ffd69fecc10d3a2b1eb6a154e6e0bd7ac2d1c694cffbf60993a36465e483545ee8c51119f529c8f3d4fec0070ef4726111829bfe964aa3

Download Submit
C:\Windows\Audio Microsoft\Microsoft Intel Audio.exe

Filesize
846KB

MD5
0936b7713936d51076fe77b8c8da04e0

SHA1
110a96f1b5c12fd037d859893a24006f0fa3fd04

SHA256
0f4d1dbae1cbb430bd201e362d7325a9a462de60d0fa04de4c3ef871de11248d

SHA512
03dc8b87e52bde6b2b42ccd763c3c38ad5ffe3d15b3f9df347ffbff083373ed7ca7598698088c80e9559f7e749ab5bf38695ca1163c12ba9ae3a7ed1fc244c62

Download Submit
C:\Windows\Audio Microsoft\Microsoft Intel Audio.exe

Filesize
846KB

MD5
0936b7713936d51076fe77b8c8da04e0

SHA1
110a96f1b5c12fd037d859893a24006f0fa3fd04

SHA256
0f4d1dbae1cbb430bd201e362d7325a9a462de60d0fa04de4c3ef871de11248d

SHA512
03dc8b87e52bde6b2b42ccd763c3c38ad5ffe3d15b3f9df347ffbff083373ed7ca7598698088c80e9559f7e749ab5bf38695ca1163c12ba9ae3a7ed1fc244c62

Download Submit
C:\Windows\Audio Microsoft\Microsoft Intel Audio.exe

Filesize
846KB

MD5
0936b7713936d51076fe77b8c8da04e0

SHA1
110a96f1b5c12fd037d859893a24006f0fa3fd04

SHA256
0f4d1dbae1cbb430bd201e362d7325a9a462de60d0fa04de4c3ef871de11248d

SHA512
03dc8b87e52bde6b2b42ccd763c3c38ad5ffe3d15b3f9df347ffbff083373ed7ca7598698088c80e9559f7e749ab5bf38695ca1163c12ba9ae3a7ed1fc244c62

Download Submit
\Windows\Audio Microsoft\Microsoft Intel Audio.exe

Filesize
846KB

MD5
0936b7713936d51076fe77b8c8da04e0

SHA1
110a96f1b5c12fd037d859893a24006f0fa3fd04

SHA256
0f4d1dbae1cbb430bd201e362d7325a9a462de60d0fa04de4c3ef871de11248d

SHA512
03dc8b87e52bde6b2b42ccd763c3c38ad5ffe3d15b3f9df347ffbff083373ed7ca7598698088c80e9559f7e749ab5bf38695ca1163c12ba9ae3a7ed1fc244c62

Download Submit
memory/888-99-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/888-96-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1516-82-0x0000000000300000-0x00000000003DA000-memory.dmp

Filesize
872KB

Download
memory/1660-59-0x0000000000DE0000-0x0000000000E2E000-memory.dmp

Filesize
312KB

Download
memory/1660-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1660-54-0x0000000000E40000-0x0000000000F1A000-memory.dmp

Filesize
872KB

Download
memory/1660-56-0x0000000000970000-0x0000000000986000-memory.dmp

Filesize
88KB

Download
memory/1660-57-0x0000000000720000-0x000000000072C000-memory.dmp

Filesize
48KB

Download
memory/1660-58-0x0000000005320000-0x00000000053A6000-memory.dmp

Filesize
536KB

Download
memory/1724-75-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1724-67-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1724-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1724-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1724-66-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1724-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1724-63-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1724-71-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads