remcos | cedca3fdf7c71fbd38e6edacb60b8b46dcd773f7b347abdd46b4f9e702c80d3f

General

Target

cedca3fdf7c71fbd38e6edacb60b8b46dcd773f7b347abdd46b4f9e702c80d3f.xls
Size

1.1MB
MD5

ebec43025b80c13f6cb6f824f1d84679
SHA1

6864ebeffa646f31672caabeba732d6612986d8a
SHA256

cedca3fdf7c71fbd38e6edacb60b8b46dcd773f7b347abdd46b4f9e702c80d3f
SHA512

a7175ab34e9d67a18719d347bd86dc59f102c2ba96da8a1a7fc62705913deb6d57e38fdb111a598a931fbf851215e3e07b74e6c679cd798f93c36f0602118033
SSDEEP

24576:Kbqr5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXImNr5XXXXXXXXXXXXUXXXXXXXSXXXt:zaif2E

Score

10^/10

remcos anothertry rat

Malware Config

Extracted

Family

remcos

Botnet

anothertry

C2

mazhararyousaf.ddns.net:52046

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-G0MHSX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

4 916 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

vbc.exevbc.exevbc.exe

pid process

2028 vbc.exe
1040 vbc.exe
1624 vbc.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

916 EQNEDT32.EXE
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

flow	pid	process
4	916	EQNEDT32.EXE

pid	process
2028	vbc.exe
1040	vbc.exe
1624	vbc.exe

pid	process
916	EQNEDT32.EXE

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc.exe

description pid process target process

PID 2028 set thread context of 1624 2028 vbc.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

916 EQNEDT32.EXE

description	pid	process	target process
PID 2028 set thread context of 1624	2028	vbc.exe	vbc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
916	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1552 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exevbc.exe

pid process

676 powershell.exe
1288 powershell.exe
2028 vbc.exe
2028 vbc.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exevbc.exepowershell.exe

description pid process

Token: SeDebugPrivilege 676 powershell.exe
Token: SeDebugPrivilege 2028 vbc.exe
Token: SeDebugPrivilege 1288 powershell.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXEvbc.exe

pid process

1552 EXCEL.EXE
1552 EXCEL.EXE
1552 EXCEL.EXE
1624 vbc.exe

pid	process
1552	EXCEL.EXE

pid	process
676	powershell.exe
1288	powershell.exe
2028	vbc.exe
2028	vbc.exe

description	pid	process
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	2028	vbc.exe
Token: SeDebugPrivilege	1288	powershell.exe

pid	process
1552	EXCEL.EXE
1552	EXCEL.EXE
1552	EXCEL.EXE
1624	vbc.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

EQNEDT32.EXEvbc.exe

description	pid	process	target process
PID 916 wrote to memory of 2028	916	EQNEDT32.EXE	vbc.exe
PID 916 wrote to memory of 2028	916	EQNEDT32.EXE	vbc.exe
PID 916 wrote to memory of 2028	916	EQNEDT32.EXE	vbc.exe
PID 916 wrote to memory of 2028	916	EQNEDT32.EXE	vbc.exe
PID 2028 wrote to memory of 676	2028	vbc.exe	powershell.exe
PID 2028 wrote to memory of 676	2028	vbc.exe	powershell.exe
PID 2028 wrote to memory of 676	2028	vbc.exe	powershell.exe
PID 2028 wrote to memory of 676	2028	vbc.exe	powershell.exe
PID 2028 wrote to memory of 1288	2028	vbc.exe	powershell.exe
PID 2028 wrote to memory of 1288	2028	vbc.exe	powershell.exe
PID 2028 wrote to memory of 1288	2028	vbc.exe	powershell.exe
PID 2028 wrote to memory of 1288	2028	vbc.exe	powershell.exe
PID 2028 wrote to memory of 1040	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1040	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1040	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1040	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe
PID 2028 wrote to memory of 1624	2028	vbc.exe	vbc.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\cedca3fdf7c71fbd38e6edacb60b8b46dcd773f7b347abdd46b4f9e702c80d3f.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1552

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-Date
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Users\Public\vbc.exe
C:\Users\Public\vbc.exe
3⤵
- Executes dropped EXE
PID:1040

C:\Users\Public\vbc.exe
C:\Users\Public\vbc.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
781c0ab5dc81a5ac4450d7f751aeccc2

SHA1
d6e1a69bf18af2e99adcd217f41d5d0bbce29cd4

SHA256
e929bcbc8300ce3be9a3593ad8e601195bb4ff127ca3cb4044586593d2d992eb

SHA512
675cfdbcabab50d16e7d7e8dabea08e67fc3337d46d5f4e09c09d75a731122deee77c195a640009812d8aa182fbe9b9c12b02b0e48ddd73bf84a0f12798b539a

Download Submit
C:\Users\Public\vbc.exe
Filesize
2.2MB

MD5
1a52cfd9752ab0dd589be194a928d402

SHA1
1223795aeff0d07a115665ff1b2268337b752395

SHA256
ad45a0b57ebfc39c8d7595c6f4ff17afc4068654ebd66d86cd5c359cf033efd8

SHA512
5bc67b5e1ab190651b189e878ec05594a7c44744f4150159b7ccda66b6540e191a2880367b591c7acb9c8040390ce81195079e63d97e1f8bd02567210c363126

Download Submit
C:\Users\Public\vbc.exe
Filesize
2.2MB

MD5
1a52cfd9752ab0dd589be194a928d402

SHA1
1223795aeff0d07a115665ff1b2268337b752395

SHA256
ad45a0b57ebfc39c8d7595c6f4ff17afc4068654ebd66d86cd5c359cf033efd8

SHA512
5bc67b5e1ab190651b189e878ec05594a7c44744f4150159b7ccda66b6540e191a2880367b591c7acb9c8040390ce81195079e63d97e1f8bd02567210c363126

Download Submit
C:\Users\Public\vbc.exe
Filesize
2.2MB

MD5
1a52cfd9752ab0dd589be194a928d402

SHA1
1223795aeff0d07a115665ff1b2268337b752395

SHA256
ad45a0b57ebfc39c8d7595c6f4ff17afc4068654ebd66d86cd5c359cf033efd8

SHA512
5bc67b5e1ab190651b189e878ec05594a7c44744f4150159b7ccda66b6540e191a2880367b591c7acb9c8040390ce81195079e63d97e1f8bd02567210c363126

Download Submit
C:\Users\Public\vbc.exe
Filesize
2.2MB

MD5
1a52cfd9752ab0dd589be194a928d402

SHA1
1223795aeff0d07a115665ff1b2268337b752395

SHA256
ad45a0b57ebfc39c8d7595c6f4ff17afc4068654ebd66d86cd5c359cf033efd8

SHA512
5bc67b5e1ab190651b189e878ec05594a7c44744f4150159b7ccda66b6540e191a2880367b591c7acb9c8040390ce81195079e63d97e1f8bd02567210c363126

Download Submit
\Users\Public\vbc.exe
Filesize
2.2MB

MD5
1a52cfd9752ab0dd589be194a928d402

SHA1
1223795aeff0d07a115665ff1b2268337b752395

SHA256
ad45a0b57ebfc39c8d7595c6f4ff17afc4068654ebd66d86cd5c359cf033efd8

SHA512
5bc67b5e1ab190651b189e878ec05594a7c44744f4150159b7ccda66b6540e191a2880367b591c7acb9c8040390ce81195079e63d97e1f8bd02567210c363126

Download Submit
memory/676-65-0x0000000000000000-mapping.dmp

Download
memory/676-71-0x0000000002550000-0x0000000002593000-memory.dmp

Filesize
268KB

Download
memory/676-68-0x0000000067FA0000-0x000000006854B000-memory.dmp

Filesize
5.7MB

Download
memory/676-72-0x0000000067FA0000-0x000000006854B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-78-0x0000000073290000-0x000000007383B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-77-0x0000000073290000-0x000000007383B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-79-0x0000000073290000-0x000000007383B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-74-0x0000000000000000-mapping.dmp

Download
memory/1552-70-0x0000000072A9D000-0x0000000072AA8000-memory.dmp

Filesize
44KB

Download
memory/1552-58-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1552-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1552-69-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1552-55-0x0000000071AB1000-0x0000000071AB3000-memory.dmp

Filesize
8KB

Download
memory/1552-54-0x000000002F2A1000-0x000000002F2A4000-memory.dmp

Filesize
12KB

Download
memory/1552-57-0x0000000072A9D000-0x0000000072AA8000-memory.dmp

Filesize
44KB

Download
memory/1624-87-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-88-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-81-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-82-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-84-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-86-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-99-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-98-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-89-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-91-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-93-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1624-94-0x000000000043292E-mapping.dmp

Download
memory/2028-61-0x0000000000000000-mapping.dmp

Download
memory/2028-73-0x00000000059E0000-0x0000000005C1C000-memory.dmp

Filesize
2.2MB

Download
memory/2028-64-0x0000000001060000-0x00000000012A0000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads