remcos | 726ff0b67faeacccd97956ddb2383026d3fea83a0d9f0ed761beeadeced8f610

Resubmissions

06/06/2023, 06:42

230606-hgjrasch41 1

06/06/2023, 06:42

06/06/2023, 06:41

06/06/2023, 06:39

06/06/2023, 06:31

06/06/2023, 06:23

Analysis

max time kernel
228s
max time network
232s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
06/06/2023, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.rar
Size

1.3MB
MD5

246eb678d0a6211d010f5465bcc604b6
SHA1

e0a121dcac8a5f5f4c4ff4f27974e8d6b9adeeea
SHA256

726ff0b67faeacccd97956ddb2383026d3fea83a0d9f0ed761beeadeced8f610
SHA512

13b913463c36fcd80ddca12132f0f70fd9edd0bbf4d1dc55a9eff24b840e6af290eadfd8e3935d0e94c7e7baeac766a10bfe6b841fddafc6147a00247932167e
SSDEEP

24576:bv7698KdrtTYfx5Osq/cHfEJtppLj6yh/vM6VnPWVj96jgxMcDb9H3rk/avJAd:C935ix0/Ywv6uXJnPApAqrbh3rMavJAd

Score

10^/10

remcos euros rat

Malware Config

Extracted

Family

remcos

Botnet

Euros

jhcdiucishcisdfs.con-ip.com:1883

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-10VB13
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
2992	DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 2280	2992	DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.exe	46

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2288	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.rar	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\rar_auto_file\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\rar_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\rar_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\rar_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.rar\ = "rar_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\rar_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\rar_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
540	rundll32.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	firefox.exe
Token: SeDebugPrivilege	976	firefox.exe
Token: SeDebugPrivilege	976	firefox.exe
Token: SeRestorePrivilege	2724	7zG.exe
Token: 35	2724	7zG.exe
Token: SeSecurityPrivilege	2724	7zG.exe
Token: SeSecurityPrivilege	2724	7zG.exe
Token: 33	2304	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2304	AUDIODG.EXE
Token: 33	2304	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2304	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
976	firefox.exe
976	firefox.exe
976	firefox.exe
976	firefox.exe
2724	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
976	firefox.exe
976	firefox.exe
976	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
976	firefox.exe
976	firefox.exe
976	firefox.exe
2280	csc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 540	628	cmd.exe	29
PID 628 wrote to memory of 540	628	cmd.exe	29
PID 628 wrote to memory of 540	628	cmd.exe	29
PID 540 wrote to memory of 1848	540	rundll32.exe	30
PID 540 wrote to memory of 1848	540	rundll32.exe	30
PID 540 wrote to memory of 1848	540	rundll32.exe	30
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 1848 wrote to memory of 976	1848	firefox.exe	31
PID 976 wrote to memory of 1260	976	firefox.exe	33
PID 976 wrote to memory of 1260	976	firefox.exe	33
PID 976 wrote to memory of 1260	976	firefox.exe	33
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34
PID 976 wrote to memory of 1912	976	firefox.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.rar
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.rar"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.rar"
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:976
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.0.1496969592\1379746467" -parentBuildID 20221007134813 -prefsHandle 1192 -prefMapHandle 1184 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99725b3f-1916-4694-977d-802d4ff97f4e} 976 "\\.\pipe\gecko-crash-server-pipe.976" 1256 139a9c58 gpu
        5⤵
        
        PID:1260
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.1.704449954\701599759" -parentBuildID 20221007134813 -prefsHandle 1460 -prefMapHandle 1456 -prefsLen 21751 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d639f35e-b99d-443e-baa5-255a9891825e} 976 "\\.\pipe\gecko-crash-server-pipe.976" 1472 e70758 socket
        5⤵
        
        PID:1912
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.2.1402317147\985378072" -childID 1 -isForBrowser -prefsHandle 1676 -prefMapHandle 912 -prefsLen 21834 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {725652f5-4d84-466b-a8dd-e8f17d844a36} 976 "\\.\pipe\gecko-crash-server-pipe.976" 2008 f399258 tab
        5⤵
        
        PID:1800
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.3.1269209781\1315561010" -childID 2 -isForBrowser -prefsHandle 2740 -prefMapHandle 2736 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e19c2e5f-dd30-49da-847f-7a262f9a00e4} 976 "\\.\pipe\gecko-crash-server-pipe.976" 2752 1ac1b558 tab
        5⤵
        
        PID:1960
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.4.1833211343\1455956241" -childID 3 -isForBrowser -prefsHandle 3632 -prefMapHandle 3616 -prefsLen 26798 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c7432ea-fc37-4070-a54d-cf427390a4ce} 976 "\\.\pipe\gecko-crash-server-pipe.976" 3660 1cf62958 tab
        5⤵
        
        PID:2408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.5.160871547\264300833" -childID 4 -isForBrowser -prefsHandle 3640 -prefMapHandle 3644 -prefsLen 26798 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a536e824-57dc-4298-9a01-4e0dbfa8ecf5} 976 "\\.\pipe\gecko-crash-server-pipe.976" 3724 1cf62358 tab
        5⤵
        
        PID:2416
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.6.1782306904\111373945" -childID 5 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 26798 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4ad8c2e-87a1-4ea0-8bfb-0599bca77cd9} 976 "\\.\pipe\gecko-crash-server-pipe.976" 3620 1f481258 tab
        5⤵
        
        PID:2436

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA\" -spe -an -ai#7zMap3752:146:7zEvent6065
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Users\Admin\Downloads\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.exe
"C:\Users\Admin\Downloads\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  PID:3000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\Downloads\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nmtc1r04.default-release\activity-stream.discovery_stream.json.tmp

Filesize
147KB

MD5
62af347703a67637a00515c3953bba9b

SHA1
dc4e5a46deee31f9d5baaa386ba62dfc85357757

SHA256
589503379680aadca4103ba5b4696481abc1ae867c0de4eae17b7862589ecf2b

SHA512
ce46dfaf990400c89b7ab111c6af1b0221c2e1afb20c3d55b0b9fba1c3958c9c9afbcad19bc6480a451d9a2134de69e77aaf676fc50fc56d1bdf9aab8b3793fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmtc1r04.default-release\prefs.js

Filesize
6KB

MD5
688e8418c56f8bc8f8f741f83d478dba

SHA1
72d1d4bf60bfa4641a44f06e268557771d06f357

SHA256
1e0cab9263cf14166ca223a8bb557403d8d52fecae6c51a2766749f0a4339b36

SHA512
1aa4b446947306aa12744f67bf04542b61fccae7ecae3abb6246ca895ad37e0fceadaf4a2353399773d1ce393fcdae7061743a3cc0a086b903690878c87fb33f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmtc1r04.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
937B

MD5
d555a3f5b63d3bff0f930fde40c083f2

SHA1
5d797903abc04a1388f468951e95b7682f314a8d

SHA256
2f55ae99e567cdbb5667533303b359f573f6b5f281a8c97cc951a912980c9137

SHA512
c41caa3964e516186243926069cfd3d381c68872dcaa834da6ad295edcd1dc20e0d23e2cdd5d93b2afc6ef39bf75745243d8bf88a966edc7e06674ed93cdbc7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmtc1r04.default-release\sessionstore.jsonlz4

Filesize
687B

MD5
47645c37fd8c5e6d43f9be9faafea491

SHA1
79b5af43a2046e9d4bda3d162b3f3191e047f951

SHA256
54f09352505c1d3271a9c644e15e8ad5433f38273bb6e03e4089c49c514522be

SHA512
af4b8fa7f70d48e98a7b346221905c04f24cf6563d097e916902b536da99f0824085b2187eb1e3bc43eda32c189341fce9b87cb395b34b79d8bebcb229b6973b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmtc1r04.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0f30c0c6cf015c003183bd2966aa4011

SHA1
884a2c66e4b26bf8ac84224d1ed01b8e4f2d59a7

SHA256
62ac97ebb8c62a2ab12bd04f67414006a92a32321d7f9a79ef774c7db2ad63ed

SHA512
76e904f0b2e00f08b14addbfd4f30a120a39a85ad1ef2e7315c3987475f1175c516217d51feface1e407b8c5730942fe4e464074a168e906deb3bdba21035121

Download Submit
C:\Users\Admin\Downloads\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.rar

Filesize
1.3MB

MD5
246eb678d0a6211d010f5465bcc604b6

SHA1
e0a121dcac8a5f5f4c4ff4f27974e8d6b9adeeea

SHA256
726ff0b67faeacccd97956ddb2383026d3fea83a0d9f0ed761beeadeced8f610

SHA512
13b913463c36fcd80ddca12132f0f70fd9edd0bbf4d1dc55a9eff24b840e6af290eadfd8e3935d0e94c7e7baeac766a10bfe6b841fddafc6147a00247932167e

Download Submit
C:\Users\Admin\Downloads\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.exe

Filesize
70.4MB

MD5
a8d04745e8499e42bdd4630a3b5dd92c

SHA1
5f7d76341a72efcc5316a339b31187a535151fbf

SHA256
f2fa9dd01a72d257d6bde350506a2c9358acef6973909d47e65c6be451966544

SHA512
80ee47394b4c0d68c8a60bd5d517212611b47ecb63462c4dcba0714cb7674c140db45a977a072ae72eee1143ea556019bd75a40f5eb11aedab78e2f475a055cc

Download Submit
C:\Users\Admin\Downloads\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA\DETALLE Y OFICIO DE CONSIGNACIÓN REALIZADA.exe

Filesize
62.7MB

MD5
019163a928e3557005a7956cf83ee3d4

SHA1
48b1e74297d63bc787644dc0e0314addb858f671

SHA256
a96dceab1927898450ca0cc2a6f086a135f18950173c1ed5ce089bfacfaf9869

SHA512
c4e8ffdbf0dbcd3d3fa2643de764734805776878710257ed66015f4cfaf7224722de9d290d67ade6c8f018231c81582a2a52717f085f4226fc35179c029a777a

Download Submit
C:\Users\Admin\Downloads\HXltaN2S.rar.part

Filesize
1.3MB

MD5
246eb678d0a6211d010f5465bcc604b6

SHA1
e0a121dcac8a5f5f4c4ff4f27974e8d6b9adeeea

SHA256
726ff0b67faeacccd97956ddb2383026d3fea83a0d9f0ed761beeadeced8f610

SHA512
13b913463c36fcd80ddca12132f0f70fd9edd0bbf4d1dc55a9eff24b840e6af290eadfd8e3935d0e94c7e7baeac766a10bfe6b841fddafc6147a00247932167e

Download Submit
memory/2280-789-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-798-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2280-788-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-817-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-790-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-791-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-792-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-793-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-796-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-816-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-800-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-797-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-805-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-810-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2280-813-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/2992-783-0x00000000020C0000-0x0000000002100000-memory.dmp

Filesize
256KB

Download
memory/2992-777-0x0000000000360000-0x00000000003EE000-memory.dmp

Filesize
568KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads