remcos | 828c067539368aee17656ddb7d1c95f9567d7f2bd80b876cabbeed104556f98b

General

Target

d34424d4ff9030116dedad2314fabbcf.rtf
Size

27KB
MD5

d34424d4ff9030116dedad2314fabbcf
SHA1

e8f114e73f8f856483d652344b4ba9334e5b0a14
SHA256

828c067539368aee17656ddb7d1c95f9567d7f2bd80b876cabbeed104556f98b
SHA512

261455fc69be967af26b3158fa606b07045adee3009c2719005bc359568652d30566066c3e87d1d1854298de746b3de3ec5622d5c2f4287af46522eee9876018
SSDEEP

384:6XbGESBab/Y3lb3JBe8o6enzwWC1orexFp2L+3+FEgTrNuHbMU+DUf/wMY/K2Qeg:ofSBx3DenzwWWoafmi/+r4HbrRb2Q75

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

divdemoce.duckdns.org:35639

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
dtas.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Rmc-GZATCK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/552-129-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral1/memory/552-142-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/2028-130-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/2028-128-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/2028-139-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/552-129-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral1/memory/2028-130-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/2028-128-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/1884-132-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1884-133-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/2028-139-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/552-142-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

3 300 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

cleanmgr.exe

pid process

984 cleanmgr.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

300 EQNEDT32.EXE

flow	pid	process
3	300	EQNEDT32.EXE

pid	process
300	EQNEDT32.EXE

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

AddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AddInProcess32.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

cleanmgr.exeAddInProcess32.exe

description	pid	process	target process
PID 984 set thread context of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 696 set thread context of 2028	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 set thread context of 552	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 set thread context of 1884	696	AddInProcess32.exe	AddInProcess32.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

300 EQNEDT32.EXE

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
300	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2000 WINWORD.EXE

pid	process
2000	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cleanmgr.exe

pid	process
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe
984	cleanmgr.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

AddInProcess32.exe

pid process

696 AddInProcess32.exe
696 AddInProcess32.exe
696 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cleanmgr.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 984 cleanmgr.exe
Token: SeDebugPrivilege 1884 AddInProcess32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WINWORD.EXEAddInProcess32.exe

pid process

2000 WINWORD.EXE
2000 WINWORD.EXE
696 AddInProcess32.exe

pid	process
696	AddInProcess32.exe
696	AddInProcess32.exe
696	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	984	cleanmgr.exe
Token: SeDebugPrivilege	1884	AddInProcess32.exe

pid	process
2000	WINWORD.EXE
2000	WINWORD.EXE
696	AddInProcess32.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

EQNEDT32.EXEcleanmgr.exeWINWORD.EXEAddInProcess32.exe

description	pid	process	target process
PID 300 wrote to memory of 984	300	EQNEDT32.EXE	cleanmgr.exe
PID 300 wrote to memory of 984	300	EQNEDT32.EXE	cleanmgr.exe
PID 300 wrote to memory of 984	300	EQNEDT32.EXE	cleanmgr.exe
PID 300 wrote to memory of 984	300	EQNEDT32.EXE	cleanmgr.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 1080	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 984 wrote to memory of 696	984	cleanmgr.exe	AddInProcess32.exe
PID 2000 wrote to memory of 1172	2000	WINWORD.EXE	splwow64.exe
PID 2000 wrote to memory of 1172	2000	WINWORD.EXE	splwow64.exe
PID 2000 wrote to memory of 1172	2000	WINWORD.EXE	splwow64.exe
PID 2000 wrote to memory of 1172	2000	WINWORD.EXE	splwow64.exe
PID 696 wrote to memory of 2028	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 2028	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 2028	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 2028	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 2028	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 552	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 552	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 552	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 552	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 552	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 1884	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 1884	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 1884	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 1884	696	AddInProcess32.exe	AddInProcess32.exe
PID 696 wrote to memory of 1884	696	AddInProcess32.exe	AddInProcess32.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d34424d4ff9030116dedad2314fabbcf.rtf"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1172

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:300

C:\Users\Public\cleanmgr.exe
"C:\Users\Public\cleanmgr.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
3⤵
PID:1080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\rowhyorwpjncynbtcmzrdvf"
4⤵
PID:2028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\bqkazgbxdzfpjtxflxmsfzzdmog"
4⤵
- Accesses Microsoft Outlook accounts
PID:552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\mkpsszmrrhxulzljciguqmumvuyszl"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rowhyorwpjncynbtcmzrdvf
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\rowhyorwpjncynbtcmzrdvf
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
fb9552301dc3876ae0663f6ec21bafb2

SHA1
74f9fa944e2deccdaed18010e36fe8e3969b9486

SHA256
146acd64f4fbb19bdda0b5b21cd23ba6c7cf9091712399a13b8a7e6d9b83d417

SHA512
4de259e0525a23743180edd3f81becb5cd134898bd4ced9246d9624aa14f64ffae07d80db58819fa12cfcbe32939df167b3489ed19dada465245c3bace081c62

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\dtas.dat
Filesize
318B

MD5
cd85875a0ee4790d338a3e64bef1907a

SHA1
c50db4926fc4823550a60fb74327c5be78071a7e

SHA256
cf3b59a3e0e7d5bedaf0a416afd31acfc3de30e6123174ff32f4c2ebdd0f92ac

SHA512
d4d63f12a598db83ef5597410de84824203d8cf676bb9d207081e65e026c64ab31282dc053ad14704c11842e87792b6478f26a5afbd09c1d3f1a9cc29c9c33f9

Download Submit
C:\Users\Public\cleanmgr.exe
Filesize
898KB

MD5
33108fe9d2b46a295190763ebb4083f7

SHA1
28926c7fd4b1271230a0cfcf2d193ef7cd08e17d

SHA256
99e559cde8a3871a1c1d045ff0f141d01aeff386c2798c127fdacdff6b193f17

SHA512
005060e50f1ddc3d721981fe433bd1a6ab9c4b57b965aa83aeab590220bd2a06aa93df25a59d5ed31e3947d85903c4910092632d27e79ad489d9af36d073458f

Download Submit
C:\Users\Public\cleanmgr.exe
Filesize
898KB

MD5
33108fe9d2b46a295190763ebb4083f7

SHA1
28926c7fd4b1271230a0cfcf2d193ef7cd08e17d

SHA256
99e559cde8a3871a1c1d045ff0f141d01aeff386c2798c127fdacdff6b193f17

SHA512
005060e50f1ddc3d721981fe433bd1a6ab9c4b57b965aa83aeab590220bd2a06aa93df25a59d5ed31e3947d85903c4910092632d27e79ad489d9af36d073458f

Download Submit
C:\Users\Public\cleanmgr.exe
Filesize
898KB

MD5
33108fe9d2b46a295190763ebb4083f7

SHA1
28926c7fd4b1271230a0cfcf2d193ef7cd08e17d

SHA256
99e559cde8a3871a1c1d045ff0f141d01aeff386c2798c127fdacdff6b193f17

SHA512
005060e50f1ddc3d721981fe433bd1a6ab9c4b57b965aa83aeab590220bd2a06aa93df25a59d5ed31e3947d85903c4910092632d27e79ad489d9af36d073458f

Download Submit
\Users\Public\cleanmgr.exe
Filesize
898KB

MD5
33108fe9d2b46a295190763ebb4083f7

SHA1
28926c7fd4b1271230a0cfcf2d193ef7cd08e17d

SHA256
99e559cde8a3871a1c1d045ff0f141d01aeff386c2798c127fdacdff6b193f17

SHA512
005060e50f1ddc3d721981fe433bd1a6ab9c4b57b965aa83aeab590220bd2a06aa93df25a59d5ed31e3947d85903c4910092632d27e79ad489d9af36d073458f

Download Submit
memory/552-142-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/552-120-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/552-129-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/552-124-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/696-175-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-148-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-183-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-176-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-112-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-147-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/696-154-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/696-146-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/696-150-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-149-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-143-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/696-184-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-114-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-102-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-103-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-106-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-104-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-107-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-108-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-109-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-110-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/696-111-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/984-78-0x0000000000A60000-0x0000000000A7A000-memory.dmp

Filesize
104KB

Download
memory/984-100-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/984-99-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/984-92-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/984-79-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/984-77-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/984-76-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/984-75-0x0000000000390000-0x00000000003A8000-memory.dmp

Filesize
96KB

Download
memory/984-74-0x00000000009C0000-0x0000000000A0A000-memory.dmp

Filesize
296KB

Download
memory/984-73-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/984-67-0x0000000000A90000-0x0000000000B76000-memory.dmp

Filesize
920KB

Download
memory/1080-83-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1080-84-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1080-86-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1080-87-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1080-80-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1080-81-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1080-82-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1080-88-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1080-85-0x0000000000080000-0x0000000000101000-memory.dmp

Filesize
516KB

Download
memory/1884-121-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1884-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1884-131-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1884-123-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1884-133-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2000-172-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2000-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2028-117-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2028-125-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2028-130-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2028-128-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2028-139-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads