modiloader | 877ab6295833fcb788316b1cbaa42602689cba90d069a4454335edc7e8fa4b88

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INV-M673778.01_CRM03283275.bat
Size

1.7MB
MD5

4684b78291fbd184c63fc72362ad6638
SHA1

18b9acfef0f9cb0bc368a3f7bab870b5c8d0ea45
SHA256

104dabc5458396ad4bc4bd595a18dd578a0fbbabcf2dc2446fa25d4dd3cd4395
SHA512

008d9be60f83bbcb8923bf63c19940e25b53c4df2ff86c3f6ce8c46d2570eebc47774179a99d05c96e87e01e40b48e8a154d4ba412ad8494f4eef4b995d24eac
SSDEEP

24576:ibbzU4JA5g17ST/0F1tjX48FSYlb+7jx9N29q6VeR6:inBA5g1uT/G1tjX48hw7jB6g8

Score

10^/10

modiloader remcos remotehost collection persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

127.0.0.1:55677

127.0.0.1:45671

mypersonrem.duckdns.org:45671

mypersonrem.duckdns.org:55677

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-146CM0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 12 IoCs

resource	yara_rule
behavioral2/memory/3120-55-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-58-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-59-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-60-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-61-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-63-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-64-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-66-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-67-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-69-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-71-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3120-98-0x0000000000D00000-0x0000000001D00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables built or packed with MPress PE compressor 14 IoCs

resource	yara_rule
behavioral2/memory/1220-74-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1660-76-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4844-77-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1220-80-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1660-79-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4844-83-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1220-88-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4844-89-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4844-87-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1220-82-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1660-72-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1660-91-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3120-93-0x000000001B3B0000-0x000000001B3C9000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3120-96-0x000000001B3B0000-0x000000001B3C9000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/1220-88-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/1220-82-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/1220-88-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/1220-82-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1692-6-0x00000000043D0000-0x00000000053D0000-memory.dmp	modiloader_stage2

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1220-88-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/1220-82-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1660-79-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/1660-91-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/1660-79-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1220-88-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4844-89-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4844-87-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1220-82-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/1660-91-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Executes dropped EXE 3 IoCs

pid	Process
1692	pointer.com
4924	easinvoker.exe
2628	easinvoker.exe

Loads dropped DLL 2 IoCs

pid	Process
4924	easinvoker.exe
2628	easinvoker.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	colorcpl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yfqfzmgj = "C:\\Users\\Public\\Yfqfzmgj.url"	pointer.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3120 set thread context of 1660	3120	colorcpl.exe	124
PID 3120 set thread context of 1220	3120	colorcpl.exe	126
PID 3120 set thread context of 4844	3120	colorcpl.exe	127

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1608	sc.exe
2008	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4248	3120	WerFault.exe	121

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3556	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe
4924	easinvoker.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3120	colorcpl.exe
3120	colorcpl.exe
3120	colorcpl.exe
3120	colorcpl.exe
3120	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	4844	colorcpl.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3120	colorcpl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3768	4996	cmd.exe	83
PID 4996 wrote to memory of 3768	4996	cmd.exe	83
PID 4996 wrote to memory of 2248	4996	cmd.exe	84
PID 4996 wrote to memory of 2248	4996	cmd.exe	84
PID 4996 wrote to memory of 3276	4996	cmd.exe	86
PID 4996 wrote to memory of 3276	4996	cmd.exe	86
PID 3276 wrote to memory of 3556	3276	cmd.exe	87
PID 3276 wrote to memory of 3556	3276	cmd.exe	87
PID 4996 wrote to memory of 2824	4996	cmd.exe	88
PID 4996 wrote to memory of 2824	4996	cmd.exe	88
PID 2824 wrote to memory of 1692	2824	cmd.exe	89
PID 2824 wrote to memory of 1692	2824	cmd.exe	89
PID 2824 wrote to memory of 1692	2824	cmd.exe	89
PID 4996 wrote to memory of 1884	4996	cmd.exe	90
PID 4996 wrote to memory of 1884	4996	cmd.exe	90
PID 1692 wrote to memory of 4228	1692	pointer.com	98
PID 1692 wrote to memory of 4228	1692	pointer.com	98
PID 1692 wrote to memory of 4228	1692	pointer.com	98
PID 4228 wrote to memory of 4164	4228	cmd.exe	100
PID 4228 wrote to memory of 4164	4228	cmd.exe	100
PID 4228 wrote to memory of 4164	4228	cmd.exe	100
PID 4228 wrote to memory of 4700	4228	cmd.exe	102
PID 4228 wrote to memory of 4700	4228	cmd.exe	102
PID 4228 wrote to memory of 4700	4228	cmd.exe	102
PID 4228 wrote to memory of 5080	4228	cmd.exe	103
PID 4228 wrote to memory of 5080	4228	cmd.exe	103
PID 4228 wrote to memory of 5080	4228	cmd.exe	103
PID 4228 wrote to memory of 2116	4228	cmd.exe	104
PID 4228 wrote to memory of 2116	4228	cmd.exe	104
PID 4228 wrote to memory of 2116	4228	cmd.exe	104
PID 4228 wrote to memory of 1576	4228	cmd.exe	105
PID 4228 wrote to memory of 1576	4228	cmd.exe	105
PID 4228 wrote to memory of 1576	4228	cmd.exe	105
PID 4228 wrote to memory of 4780	4228	cmd.exe	106
PID 4228 wrote to memory of 4780	4228	cmd.exe	106
PID 4228 wrote to memory of 4780	4228	cmd.exe	106
PID 4228 wrote to memory of 5096	4228	cmd.exe	107
PID 4228 wrote to memory of 5096	4228	cmd.exe	107
PID 4228 wrote to memory of 5096	4228	cmd.exe	107
PID 4228 wrote to memory of 624	4228	cmd.exe	108
PID 4228 wrote to memory of 624	4228	cmd.exe	108
PID 4228 wrote to memory of 624	4228	cmd.exe	108
PID 4228 wrote to memory of 1044	4228	cmd.exe	109
PID 4228 wrote to memory of 1044	4228	cmd.exe	109
PID 4228 wrote to memory of 1044	4228	cmd.exe	109
PID 4228 wrote to memory of 4924	4228	cmd.exe	110
PID 4228 wrote to memory of 4924	4228	cmd.exe	110
PID 4924 wrote to memory of 780	4924	easinvoker.exe	111
PID 4924 wrote to memory of 780	4924	easinvoker.exe	111
PID 780 wrote to memory of 2212	780	cmd.exe	113
PID 780 wrote to memory of 2212	780	cmd.exe	113
PID 780 wrote to memory of 1608	780	cmd.exe	114
PID 780 wrote to memory of 1608	780	cmd.exe	114
PID 780 wrote to memory of 2008	780	cmd.exe	116
PID 780 wrote to memory of 2008	780	cmd.exe	116
PID 2212 wrote to memory of 3172	2212	cmd.exe	117
PID 2212 wrote to memory of 3172	2212	cmd.exe	117
PID 1692 wrote to memory of 4060	1692	pointer.com	118
PID 1692 wrote to memory of 4060	1692	pointer.com	118
PID 1692 wrote to memory of 4060	1692	pointer.com	118
PID 4060 wrote to memory of 2628	4060	cmd.exe	120
PID 4060 wrote to memory of 2628	4060	cmd.exe	120
PID 1692 wrote to memory of 3120	1692	pointer.com	121
PID 1692 wrote to memory of 3120	1692	pointer.com	121

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\INV-M673778.01_CRM03283275.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\system32\cmd.exe
  cmd /c del "C:\Users\Public\pointer.com" / A / F / Q / S
  2⤵
  PID:3768
- C:\Windows\system32\certutil.exe
  certutil -decodehex "C:\Users\Admin\AppData\Local\Temp\INV-M673778.01_CRM03283275.bat" "C:\Users\Public\pointer.com" 3
  2⤵
  PID:2248
- C:\Windows\system32\cmd.exe
  cmd /c PING -n 2 127.0.0.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\system32\PING.EXE
    PING -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3556
- C:\Windows\system32\cmd.exe
  cmd /c start C:\Users\Public\pointer.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Public\pointer.com
    C:\Users\Public\pointer.com
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\YfqfzmgjO.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c mkdir "\\?\C:\Windows "
        5⤵
        
        PID:4164
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        5⤵
        
        PID:4700
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y
        5⤵
        Enumerates system info in registry
        
        PID:5080
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        5⤵
        
        PID:2116
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y
        5⤵
        Enumerates system info in registry
        
        PID:1576
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        5⤵
        
        PID:4780
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y
        5⤵
        Enumerates system info in registry
        
        PID:5096
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        5⤵
        
        PID:624
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "x.bat" "C:\Windows \System32\" /K /D /H /Y
        5⤵
        Enumerates system info in registry
        
        PID:1044
    - - C:\Windows \System32\easinvoker.exe
        
        "C:\\Windows \\System32\\easinvoker.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4924
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:780
        
        C:\Windows\system32\cmd.exe
        
        cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
        
        C:\Windows\system32\sc.exe
        
        sc.exe create truesight binPath="C:\Users\Public\Libraries\truesight.sys" type=kernel
        7⤵
        Launches sc.exe
        
        PID:1608
        
        C:\Windows\system32\sc.exe
        
        sc.exe start truesight
        7⤵
        Launches sc.exe
        
        PID:2008
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\\Windows \\System32\\easinvoker.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4060
    - - C:\Windows \System32\easinvoker.exe
        
        "C:\\Windows \\System32\\easinvoker.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2628
  - - C:\Windows\SysWOW64\colorcpl.exe
      C:\Windows\System32\colorcpl.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      PID:3120
    - - C:\Windows\SysWOW64\colorcpl.exe
        
        C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\htfonisnjloiblhaytt"
        5⤵
        
        PID:412
    - - C:\Windows\SysWOW64\colorcpl.exe
        
        C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\htfonisnjloiblhaytt"
        5⤵
        
        PID:1660
    - - C:\Windows\SysWOW64\colorcpl.exe
        
        C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\jvtgoadpxtgulrdepeoqatz"
        5⤵
        
        PID:4692
    - - C:\Windows\SysWOW64\colorcpl.exe
        
        C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\jvtgoadpxtgulrdepeoqatz"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:1220
    - - C:\Windows\SysWOW64\colorcpl.exe
        
        C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\uqyrptnilbyzofriyoaslfuulj"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 1532
        5⤵
        Program crash
        
        PID:4248
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 0
  2⤵
  PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3120 -ip 3120
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qokxbxnx.tpy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\htfonisnjloiblhaytt

Filesize
4KB

MD5
a4b83bf48e62a41c2f45628d10c5bba1

SHA1
2596a41d8da2eb88f7f69e27cc16a046a2287f35

SHA256
7b29149f6971b7fba6137f401c2d515cc576dafd233b7d312dd7d818b9f91829

SHA512
afcaee732127ad05cc70a2a9cca8e4ccdcacf8161b16ed4c5e346418a7c221f3da4f20d95b449fb813a6ccbd2aad05a3a9449a9db01f8fd5c132068d1cf4c7bd

Download Submit
C:\Users\Public\Libraries\KDECO.bat

Filesize
4KB

MD5
785e8193007bcd7858b9df41c9d45f89

SHA1
29b206de05ab075138ca9e0b9fccdddf3c30cdfe

SHA256
c8e1912a3328802e98563e32eb053ae3e28249b701054af227e9f1ba6bfe24d9

SHA512
a4d6fd586800f27939d8c152e89d2a231dc9fd8466e715dfeba22e2aa0428509095e12e6e66f2cb5e40ff5c998b439dc3f6792e20c179f41ac9cae31ada9d45f

Download Submit
C:\Users\Public\Libraries\YfqfzmgjO.bat

Filesize
7KB

MD5
0d0d24b46d4bb0e4962595d455020d48

SHA1
48b247c1cb2577b28aabd7dfa999e0642b5dc6de

SHA256
f46e0cc2c119a32dd87edf97bfc73d985ee97d2c9dc00274b6b20d641e29deea

SHA512
d5a8779e1cfd2a284173ce8a205cacb41fc7c744fa84e55682ac50b327c676ff50f668ecd176e0ab84420d143a8023d8b4590362b223704c55f5b0d7e116ba2c

Download Submit
C:\Users\Public\Libraries\easinvoker.exe

Filesize
128KB

MD5
231ce1e1d7d98b44371ffff407d68b59

SHA1
25510d0f6353dbf0c9f72fc880de7585e34b28ff

SHA256
30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

SHA512
520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

Download Submit
C:\Users\Public\Libraries\netutils.dll

Filesize
115KB

MD5
39be9ce198b925133f2597d6b3017a06

SHA1
a9ac8167f2018ff331b6d6c88a9dc35df40b1f5e

SHA256
6da1571c3392650a1e125c3d37d674140896c10da705c052375992997de77281

SHA512
78df6a17b2b345d1bdd09e30aceb15e3df6cf0d5c2f202ca443cb461ad66fb178eb08c704ffb94a9966d60b1f015338cb0164c03ad07c1282052872bb65eea0d

Download Submit
C:\Users\Public\pointer.com

Filesize
1.2MB

MD5
d14f89ddd1132f5fcfb7ae6beb00ddd8

SHA1
7ead6b2af17ed2e387ef917ad72eb64165768291

SHA256
3d16630c2cd9dd265f07dc3399c679233f2908baf02ea279ff0b0e8f7eee77b2

SHA512
a7a4ca888d6799bfade22b75894124dfc922634e2215c2247b388799aa566388115aebb109cc2fc2983498311839366bd5cc438f5d8f1b56c8cc92cbb6e1a3e8

Download Submit
memory/1220-80-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1220-74-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1220-82-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1220-88-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1660-79-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1660-91-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1660-76-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1660-72-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1692-6-0x00000000043D0000-0x00000000053D0000-memory.dmp

Filesize
16.0MB

Download
memory/1692-5-0x00000000043D0000-0x00000000053D0000-memory.dmp

Filesize
16.0MB

Download
memory/1692-56-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/1692-8-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/1692-4-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/2628-52-0x00000000613C0000-0x00000000613E3000-memory.dmp

Filesize
140KB

Download
memory/3120-66-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-69-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-61-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-63-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-64-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-59-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-67-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-93-0x000000001B3B0000-0x000000001B3C9000-memory.dmp

Filesize
100KB

Download
memory/3120-71-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-58-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-55-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-98-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3120-96-0x000000001B3B0000-0x000000001B3C9000-memory.dmp

Filesize
100KB

Download
memory/3120-60-0x0000000000D00000-0x0000000001D00000-memory.dmp

Filesize
16.0MB

Download
memory/3172-43-0x000001BCAA700000-0x000001BCAA710000-memory.dmp

Filesize
64KB

Download
memory/3172-44-0x000001BCAA700000-0x000001BCAA710000-memory.dmp

Filesize
64KB

Download
memory/3172-42-0x000001BCAA700000-0x000001BCAA710000-memory.dmp

Filesize
64KB

Download
memory/3172-41-0x00007FF88EAA0000-0x00007FF88F561000-memory.dmp

Filesize
10.8MB

Download
memory/3172-36-0x000001BCAC7B0000-0x000001BCAC7D2000-memory.dmp

Filesize
136KB

Download
memory/3172-47-0x00007FF88EAA0000-0x00007FF88F561000-memory.dmp

Filesize
10.8MB

Download
memory/4844-89-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4844-87-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4844-83-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4844-77-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4924-29-0x00000000613C0000-0x00000000613E3000-memory.dmp

Filesize
140KB

Download