remcos | 8a52d87aa80812e9d072f7f197f320f8a7d253ddc1a6070b014cb35189d3fddd

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe
Size 1.0MB
Sample240105-nbzhfsbcf9
SHA256 8a52d87aa80812e9d072f7f197f320f8a7d253ddc1a6070b014cb35189d3fddd
MD5 cc8376cea9336a97ac76e52ad86dab44
SHA1 5c6bcce410b28b15be0bbde30dd3589a9902eded
SHA512 207a883646b4b1856a34b77c6f20b00800bf6167b411f61f04cc147a84706b44183445dbfbd561262380e9ea10998f8b0ade78074fb5b7b7126ad24d33b04d61
SSDEEP 24576:4olzQOIF6HX6hIVhoK768OIoC+/Ucp/AYRyQgmx:JlMOIF6HX6hshFOIV8U4/qO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos pc persistence rat

Malware Config

Extracted

Family

remcos

Botnet

107.175.229.139:8087

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-X5MJYU
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	Powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	Powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1340	remcos.exe
3292	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-X5MJYU = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-X5MJYU = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-X5MJYU = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-X5MJYU = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3492 set thread context of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 1340 set thread context of 3292	1340	remcos.exe	97
PID 3292 set thread context of 1332	3292	remcos.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2604	Powershell.exe
2604	Powershell.exe
2032	Powershell.exe
2032	Powershell.exe
1528	msedge.exe
1528	msedge.exe
3556	msedge.exe
3556	msedge.exe
4832	identity_helper.exe
4832	identity_helper.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3292	remcos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	Powershell.exe
Token: SeDebugPrivilege	2032	Powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 2604	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	92
PID 3492 wrote to memory of 2604	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	92
PID 3492 wrote to memory of 2604	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	92
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3492 wrote to memory of 3916	3492	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	93
PID 3916 wrote to memory of 1340	3916	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	96
PID 3916 wrote to memory of 1340	3916	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	96
PID 3916 wrote to memory of 1340	3916	SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe	96
PID 1340 wrote to memory of 2032	1340	remcos.exe	94
PID 1340 wrote to memory of 2032	1340	remcos.exe	94
PID 1340 wrote to memory of 2032	1340	remcos.exe	94
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 1340 wrote to memory of 3292	1340	remcos.exe	97
PID 3292 wrote to memory of 1332	3292	remcos.exe	98
PID 3292 wrote to memory of 1332	3292	remcos.exe	98
PID 3292 wrote to memory of 1332	3292	remcos.exe	98
PID 3292 wrote to memory of 1332	3292	remcos.exe	98
PID 1332 wrote to memory of 3556	1332	iexplore.exe	99
PID 1332 wrote to memory of 3556	1332	iexplore.exe	99
PID 3556 wrote to memory of 5000	3556	msedge.exe	100
PID 3556 wrote to memory of 5000	3556	msedge.exe	100
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103
PID 3556 wrote to memory of 3884	3556	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.GXH.gen.Eldorado.21748.1972.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3292
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f0ab46f8,0x7ff8f0ab4708,0x7ff8f0ab4718
        7⤵
        
        PID:5000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
        7⤵
        
        PID:2976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        7⤵
        
        PID:3884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        7⤵
        
        PID:4504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
        7⤵
        
        PID:3552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
        7⤵
        
        PID:1288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
        7⤵
        
        PID:4976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
        7⤵
        
        PID:3668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
        7⤵
        
        PID:1772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
        7⤵
        
        PID:1924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
        7⤵
        
        PID:208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
        7⤵
        
        PID:4340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
        7⤵
        
        PID:5200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
        7⤵
        
        PID:5428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
        7⤵
        
        PID:5740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4260 /prefetch:2
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8731283862646186037,13604509654659148060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
        7⤵
        
        PID:1456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:1480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\ProgramData\Remcos\remcos.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f0ab46f8,0x7ff8f0ab4708,0x7ff8f0ab4718
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 4KB
SHA256 34ca6c77ac66ae774582f92a25cc30309b2ea9373f11e6755239a7ab16b00727
MD5 ddca453dc2fc8c50421848f617ed9db5
SHA1 01ec2efb0257df03901b9157891c174f174e04e5
SHA512 4e0a58f9d61ed652e01e73331947d2a4f808936f44bb603106521fae527939b0aecc83ba241601fc502a224c3d23686b96a99ed00a89fac4cd0a8eacd954f856
SSDEEP 96:i9jafuEiklih/cI9URXl8Rotoehc2PSQhvfzxJ4uTLKb6F8e4aPu:6wiNe2RUtPSkzxxfKb6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 4KB
SHA256 9d3c696eb7985115e31234f1547ebf04fe5fae47bca1fdd6cd37455d1dbb8e63
MD5 c4fb4990221ed810f1a5a39d6bb1d973
SHA1 570181ab3b7b112b4d148ba6aa4f5697d4157216
SHA512 df7b48d1819dbf22225eeac6fe30e68389d5487009efdc80a7e8e4d98fa9f8fb26b41d275ea2fc728903d114f667cf5c52dc219753a9948e2ddcef82aa5a63ed
SSDEEP 96:i9jafuEiklih/cI9URXl8Rotoehc2PSVvkuTLKb6F8e4UPu:6wiNe2RUtPSlfKb6E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1332-74-0x0000000000700000-0x0000000000812000-memory.dmp

Download

memory/1340-46-0x0000000074EA0000-0x0000000075650000-memory.dmp

Download

memory/1340-72-0x0000000074EA0000-0x0000000075650000-memory.dmp

Download

memory/1340-47-0x00000000051B0000-0x00000000051C0000-memory.dmp

Download

memory/2032-81-0x0000000074EA0000-0x0000000075650000-memory.dmp

Download

memory/2032-49-0x00000000047C0000-0x00000000047D0000-memory.dmp

Download

memory/2032-50-0x00000000047C0000-0x00000000047D0000-memory.dmp

Download

memory/2032-48-0x0000000074EA0000-0x0000000075650000-memory.dmp

Download

memory/2604-60-0x0000000006F00000-0x0000000006F96000-memory.dmp

Download

memory/2604-10-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Download

memory/2604-12-0x0000000005050000-0x0000000005072000-memory.dmp

Download

memory/2604-13-0x0000000005840000-0x00000000058A6000-memory.dmp

Download

memory/2604-14-0x00000000058B0000-0x0000000005916000-memory.dmp

Download

memory/2604-24-0x0000000005920000-0x0000000005C74000-memory.dmp

Download

memory/2604-30-0x0000000005F20000-0x0000000005F3E000-memory.dmp

Download

memory/2604-66-0x0000000074EA0000-0x0000000075650000-memory.dmp

Download

memory/2604-62-0x0000000006450000-0x0000000006472000-memory.dmp

Download

memory/2604-33-0x0000000005F60000-0x0000000005FAC000-memory.dmp

Download

memory/2604-61-0x0000000006400000-0x000000000641A000-memory.dmp

Download

memory/2604-8-0x0000000074EA0000-0x0000000075650000-memory.dmp

Download

memory/2604-7-0x00000000025E0000-0x0000000002616000-memory.dmp

Download

memory/2604-11-0x00000000050E0000-0x0000000005708000-memory.dmp

Download

memory/2604-9-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Download

memory/3292-69-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3292-71-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3292-75-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3292-73-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3492-5-0x0000000004BC0000-0x0000000004C52000-memory.dmp

Download

memory/3492-4-0x00000000050D0000-0x0000000005674000-memory.dmp

Download

memory/3492-32-0x0000000074EA0000-0x0000000075650000-memory.dmp

Download

memory/3492-1-0x0000000074EA0000-0x0000000075650000-memory.dmp

Download

memory/3492-0-0x0000000000100000-0x0000000000212000-memory.dmp

Download

memory/3492-6-0x0000000004D00000-0x0000000004D9C000-memory.dmp

Download

memory/3492-2-0x00000000049F0000-0x0000000004A00000-memory.dmp

Download

memory/3492-3-0x0000000004A70000-0x0000000004B1E000-memory.dmp

Download

memory/3492-25-0x0000000004B80000-0x0000000004B88000-memory.dmp

Download

memory/3916-29-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3916-45-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3916-26-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3916-31-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3916-28-0x0000000000400000-0x0000000000482000-memory.dmp

Download