remcos | c8d3e42842b7f455b7b98cfee659d11d43c66fce89799f40f38b1b51a7405cad

Analysis

max time kernel
149s
max time network
113s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-03-2023 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL-DELIVERY.xls
Size

1.1MB
MD5

be84f1e6413ba0bb6ec49d35823d1595
SHA1

b9553cf3e10c59317911b8696a395ff8b25313e5
SHA256

c8d3e42842b7f455b7b98cfee659d11d43c66fce89799f40f38b1b51a7405cad
SHA512

78df095f3856846ba80f67397d75b417011c711ce3ba46f2d466a08799c08f84726496551eeb7f63eff7cc04d497f4b4b8305bee86b0fc9c8eba7240d5b5fff6
SSDEEP

24576:GLKJWQmmav30x6+MXUu9/VSP+MXUu9L3bVh+MXUu9c3bV5zkkz4C/V:GLKYQmmQ30w+MXV9tA+MXV9L3bVh+MXK

Score

10^/10

remcos first-send persistence rat

Malware Config

Extracted

Family

remcos

Botnet

First-Send

top.not4abuse1.xyz:1558

sub.not4abuse1.xyz:1558

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
rmcs
mouse_option
false
mutex
Rmc-4RNJ4J
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
20
startup_value
Remcos
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
Mail;Payment;Bank

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

3 304 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

vbc.exeaccpwujww.exeaccpwujww.exe

pid process

1720 vbc.exe
2012 accpwujww.exe
824 accpwujww.exe
Loads dropped DLL 4 IoCs

Processes:

EQNEDT32.EXEvbc.exeaccpwujww.exe

pid process

304 EQNEDT32.EXE
1720 vbc.exe
1720 vbc.exe
2012 accpwujww.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

flow	pid	process
3	304	EQNEDT32.EXE

pid	process
1720	vbc.exe
2012	accpwujww.exe
824	accpwujww.exe

pid	process
304	EQNEDT32.EXE
1720	vbc.exe
1720	vbc.exe
2012	accpwujww.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

accpwujww.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\wfvagnchfieng = "C:\\Users\\Admin\\AppData\\Roaming\\vqbyhielrdllo\\hjsxhyymsvw.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\accpwujww.exe\" C:\\Users\\Admin\\AppD"	accpwujww.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

accpwujww.exe

description pid process target process

PID 2012 set thread context of 824 2012 accpwujww.exe accpwujww.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

304 EQNEDT32.EXE

description	pid	process	target process
PID 2012 set thread context of 824	2012	accpwujww.exe	accpwujww.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
304	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1748 EXCEL.EXE
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

accpwujww.exe

pid process

2012 accpwujww.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXEaccpwujww.exe

pid process

1748 EXCEL.EXE
1748 EXCEL.EXE
1748 EXCEL.EXE
824 accpwujww.exe

pid	process
1748	EXCEL.EXE

pid	process
2012	accpwujww.exe

pid	process
1748	EXCEL.EXE
1748	EXCEL.EXE
1748	EXCEL.EXE
824	accpwujww.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

EQNEDT32.EXEvbc.exeaccpwujww.exe

description	pid	process	target process
PID 304 wrote to memory of 1720	304	EQNEDT32.EXE	vbc.exe
PID 304 wrote to memory of 1720	304	EQNEDT32.EXE	vbc.exe
PID 304 wrote to memory of 1720	304	EQNEDT32.EXE	vbc.exe
PID 304 wrote to memory of 1720	304	EQNEDT32.EXE	vbc.exe
PID 1720 wrote to memory of 2012	1720	vbc.exe	accpwujww.exe
PID 1720 wrote to memory of 2012	1720	vbc.exe	accpwujww.exe
PID 1720 wrote to memory of 2012	1720	vbc.exe	accpwujww.exe
PID 1720 wrote to memory of 2012	1720	vbc.exe	accpwujww.exe
PID 2012 wrote to memory of 824	2012	accpwujww.exe	accpwujww.exe
PID 2012 wrote to memory of 824	2012	accpwujww.exe	accpwujww.exe
PID 2012 wrote to memory of 824	2012	accpwujww.exe	accpwujww.exe
PID 2012 wrote to memory of 824	2012	accpwujww.exe	accpwujww.exe
PID 2012 wrote to memory of 824	2012	accpwujww.exe	accpwujww.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\DHL-DELIVERY.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1748

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
"C:\Users\Admin\AppData\Local\Temp\accpwujww.exe" C:\Users\Admin\AppData\Local\Temp\whgyqbmwow.k
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
"C:\Users\Admin\AppData\Local\Temp\accpwujww.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Exploitation for Client Execution

T1203

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\rmcs\logs.dat
Filesize
226B

MD5
76ebc3a950ddf44e6cc7d695715454e0

SHA1
1143e5b1f6e983356781c7ea92ebc200249244d5

SHA256
7eba782ff902cea037a8dbc314873c00febe9e6d85a041f81188908d67f96218

SHA512
f080871379f11f9b4fb7200f5c60bc030c84a4f00e6c6f8a80170814e97df646bdcad8bbcf384fe7b7f84c0ac256a1d1de9e6c1b8dfcb7ff71c9ac030a9c81bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BD55D947.emf
Filesize
95KB

MD5
9b64927d4df13951334423d6cafb9b11

SHA1
de9856cd9ee39feabedbf406168d4cc81ff7fd1f

SHA256
757362ca9f59ff2d70df6c92730d7c7aa8fe772030f9e97a444f8e7cba93695c

SHA512
47aff183e94548820bc3e34be7db2a7dc8bca19945a7228fb77f40780f6fe97a3e2e0f44d5a4e36f6551ec0c26f605fc66e2786b34d26bbc796f28f3b2c4e209

Download Submit
C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
Filesize
5KB

MD5
03ae60a2d54117341e743be868497268

SHA1
abc4d195b5ad951058714cb38bf1ef62ca51086b

SHA256
0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

SHA512
b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
Filesize
5KB

MD5
03ae60a2d54117341e743be868497268

SHA1
abc4d195b5ad951058714cb38bf1ef62ca51086b

SHA256
0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

SHA512
b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
Filesize
5KB

MD5
03ae60a2d54117341e743be868497268

SHA1
abc4d195b5ad951058714cb38bf1ef62ca51086b

SHA256
0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

SHA512
b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
Filesize
5KB

MD5
03ae60a2d54117341e743be868497268

SHA1
abc4d195b5ad951058714cb38bf1ef62ca51086b

SHA256
0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

SHA512
b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\gzqeznlmgbv.nua
Filesize
495KB

MD5
7871964204bbe6aad682859785968397

SHA1
13e83bf6a1bac3f1779610f4ac47235cd47bb9b4

SHA256
b41f8b955f6f159ff0d5065d855d89d5528f5a27f0d06c5d15748ad62c2d71da

SHA512
85b87885ab152d667cc0df2626275ada680224d4c8d686e985d578fed12be524215bb8392528af818b734b2f994979893b44e6694863fe2976959960f7f280ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\whgyqbmwow.k
Filesize
7KB

MD5
efd98d26091eabe73cae73972699c29e

SHA1
2b9d4cc399b13d10fe7ddc1cb84df4145c4b7ed4

SHA256
c7a7d9d6aacbce80718605b692fe8c5e13cf3410c1e2ab44ff979a790c918e54

SHA512
718a5efffa704ad2bc38a06fbfb749cef018c86177e5de91574b3a5593a303f8a2b0320ba1db16e96f4ba2d331976938e3a399f0e1031d00646eacebfee82bc7

Download Submit
C:\Users\Public\vbc.exe
Filesize
490KB

MD5
e71210a8cb9a16fe0b777e20ab8750cf

SHA1
16ed028a56c4a6b008f66062e574664020cf1d30

SHA256
a65de678bfc68fa18936e353ba96fed7f00134a30ead01a45f88e10adb33be9b

SHA512
6fa9b47082d9212f669563806108e682fda1fdd71b343e21fd93e2163512024d560524bf2b8ebde927035447d85ca0ce8aa925b6b216c0dcb38743b2ea3e42ab

Download Submit
C:\Users\Public\vbc.exe
Filesize
490KB

MD5
e71210a8cb9a16fe0b777e20ab8750cf

SHA1
16ed028a56c4a6b008f66062e574664020cf1d30

SHA256
a65de678bfc68fa18936e353ba96fed7f00134a30ead01a45f88e10adb33be9b

SHA512
6fa9b47082d9212f669563806108e682fda1fdd71b343e21fd93e2163512024d560524bf2b8ebde927035447d85ca0ce8aa925b6b216c0dcb38743b2ea3e42ab

Download Submit
C:\Users\Public\vbc.exe
Filesize
490KB

MD5
e71210a8cb9a16fe0b777e20ab8750cf

SHA1
16ed028a56c4a6b008f66062e574664020cf1d30

SHA256
a65de678bfc68fa18936e353ba96fed7f00134a30ead01a45f88e10adb33be9b

SHA512
6fa9b47082d9212f669563806108e682fda1fdd71b343e21fd93e2163512024d560524bf2b8ebde927035447d85ca0ce8aa925b6b216c0dcb38743b2ea3e42ab

Download Submit
\Users\Admin\AppData\Local\Temp\accpwujww.exe
Filesize
5KB

MD5
03ae60a2d54117341e743be868497268

SHA1
abc4d195b5ad951058714cb38bf1ef62ca51086b

SHA256
0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

SHA512
b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

Download Submit
\Users\Admin\AppData\Local\Temp\accpwujww.exe
Filesize
5KB

MD5
03ae60a2d54117341e743be868497268

SHA1
abc4d195b5ad951058714cb38bf1ef62ca51086b

SHA256
0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

SHA512
b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

Download Submit
\Users\Admin\AppData\Local\Temp\accpwujww.exe
Filesize
5KB

MD5
03ae60a2d54117341e743be868497268

SHA1
abc4d195b5ad951058714cb38bf1ef62ca51086b

SHA256
0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

SHA512
b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

Download Submit
\Users\Public\vbc.exe
Filesize
490KB

MD5
e71210a8cb9a16fe0b777e20ab8750cf

SHA1
16ed028a56c4a6b008f66062e574664020cf1d30

SHA256
a65de678bfc68fa18936e353ba96fed7f00134a30ead01a45f88e10adb33be9b

SHA512
6fa9b47082d9212f669563806108e682fda1fdd71b343e21fd93e2163512024d560524bf2b8ebde927035447d85ca0ce8aa925b6b216c0dcb38743b2ea3e42ab

Download Submit
memory/824-99-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-115-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-94-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-95-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-97-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-160-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-100-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-103-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-105-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-107-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-91-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-110-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-113-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-92-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-118-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-121-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-124-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-132-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-157-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-87-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-149-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-150-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-152-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/824-154-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1748-133-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1748-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download