remcos | 00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

Resubmissions

21-03-2024 08:04

240321-jydgaagd5x 10

13-03-2024 17:04

240313-vlgtqaad4y 10

Analysis

max time kernel
149s
max time network
132s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
13-03-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vencord.exe
Size

469KB
MD5

e206c8908d5c24a3dda14322807d8e50
SHA1

144d9d69ba30e08dbe79ac3fae47e7c88aedb448
SHA256

00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e
SHA512

9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS5n9:uiLJbpI7I2WhQqZ759

Score

10^/10

remcos vencord persistence rat

Malware Config

Extracted

Family

remcos

Botnet

VenCord

147.185.221.18:52136

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
scvhost.exe
copy_folder
System64
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
yh?0J?xxu¢iw)>zqn*'^?^^_wh+ru?*&~2yzwL\"s?>yhi)?0J?xxuz,-QZL639
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
DiscordUpdate
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe

Executes dropped EXE 1 IoCs

pid	Process
4180	scvhost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe
File created	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 3784	4180	scvhost.exe	77
PID 3784 set thread context of 4296	3784	svchost.exe	78
PID 3784 set thread context of 204	3784	svchost.exe	79
PID 3784 set thread context of 3216	3784	svchost.exe	80
PID 3784 set thread context of 3500	3784	svchost.exe	81
PID 3784 set thread context of 4552	3784	svchost.exe	82
PID 3784 set thread context of 1468	3784	svchost.exe	83
PID 3784 set thread context of 4376	3784	svchost.exe	84
PID 3784 set thread context of 3356	3784	svchost.exe	85
PID 3784 set thread context of 588	3784	svchost.exe	86
PID 3784 set thread context of 2160	3784	svchost.exe	88
PID 3784 set thread context of 3396	3784	svchost.exe	89
PID 3784 set thread context of 3672	3784	svchost.exe	90
PID 3784 set thread context of 1656	3784	svchost.exe	91
PID 3784 set thread context of 4624	3784	svchost.exe	92
PID 3784 set thread context of 2516	3784	svchost.exe	93
PID 3784 set thread context of 3540	3784	svchost.exe	94
PID 3784 set thread context of 1688	3784	svchost.exe	96
PID 3784 set thread context of 4444	3784	svchost.exe	97
PID 3784 set thread context of 4508	3784	svchost.exe	98
PID 3784 set thread context of 1196	3784	svchost.exe	99
PID 3784 set thread context of 3504	3784	svchost.exe	100
PID 3784 set thread context of 4792	3784	svchost.exe	101
PID 3784 set thread context of 4240	3784	svchost.exe	102
PID 3784 set thread context of 2656	3784	svchost.exe	103
PID 3784 set thread context of 2500	3784	svchost.exe	104
PID 3784 set thread context of 4420	3784	svchost.exe	105
PID 3784 set thread context of 4036	3784	svchost.exe	106
PID 3784 set thread context of 484	3784	svchost.exe	107
PID 3784 set thread context of 508	3784	svchost.exe	108
PID 3784 set thread context of 428	3784	svchost.exe	109
PID 3784 set thread context of 4088	3784	svchost.exe	110
PID 3784 set thread context of 1588	3784	svchost.exe	111
PID 3784 set thread context of 3664	3784	svchost.exe	112
PID 3784 set thread context of 2996	3784	svchost.exe	113
PID 3784 set thread context of 4184	3784	svchost.exe	114
PID 3784 set thread context of 2592	3784	svchost.exe	115
PID 3784 set thread context of 3980	3784	svchost.exe	116
PID 3784 set thread context of 1352	3784	svchost.exe	117
PID 3784 set thread context of 3508	3784	svchost.exe	118
PID 3784 set thread context of 2156	3784	svchost.exe	119
PID 3784 set thread context of 2180	3784	svchost.exe	120
PID 3784 set thread context of 1644	3784	svchost.exe	121
PID 3784 set thread context of 4528	3784	svchost.exe	122
PID 3784 set thread context of 2504	3784	svchost.exe	123
PID 3784 set thread context of 2536	3784	svchost.exe	124
PID 3784 set thread context of 4580	3784	svchost.exe	125
PID 3784 set thread context of 4492	3784	svchost.exe	126
PID 3784 set thread context of 1036	3784	svchost.exe	127
PID 3784 set thread context of 5012	3784	svchost.exe	128
PID 3784 set thread context of 3636	3784	svchost.exe	129
PID 3784 set thread context of 4852	3784	svchost.exe	130
PID 3784 set thread context of 2332	3784	svchost.exe	131
PID 3784 set thread context of 2972	3784	svchost.exe	132
PID 3784 set thread context of 1856	3784	svchost.exe	133
PID 3784 set thread context of 3288	3784	svchost.exe	134
PID 3784 set thread context of 4120	3784	svchost.exe	135
PID 3784 set thread context of 1336	3784	svchost.exe	136
PID 3784 set thread context of 1392	3784	svchost.exe	137
PID 3784 set thread context of 196	3784	svchost.exe	138
PID 3784 set thread context of 2868	3784	svchost.exe	139
PID 3784 set thread context of 3788	3784	svchost.exe	140
PID 3784 set thread context of 4708	3784	svchost.exe	141
PID 3784 set thread context of 1912	3784	svchost.exe	142

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings	Vencord.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4180	scvhost.exe
4180	scvhost.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4180	scvhost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe
3784	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 428	1424	Vencord.exe	73
PID 1424 wrote to memory of 428	1424	Vencord.exe	73
PID 1424 wrote to memory of 428	1424	Vencord.exe	73
PID 428 wrote to memory of 2208	428	WScript.exe	74
PID 428 wrote to memory of 2208	428	WScript.exe	74
PID 428 wrote to memory of 2208	428	WScript.exe	74
PID 2208 wrote to memory of 4180	2208	cmd.exe	76
PID 2208 wrote to memory of 4180	2208	cmd.exe	76
PID 2208 wrote to memory of 4180	2208	cmd.exe	76
PID 4180 wrote to memory of 3784	4180	scvhost.exe	77
PID 4180 wrote to memory of 3784	4180	scvhost.exe	77
PID 4180 wrote to memory of 3784	4180	scvhost.exe	77
PID 4180 wrote to memory of 3784	4180	scvhost.exe	77
PID 3784 wrote to memory of 4296	3784	svchost.exe	78
PID 3784 wrote to memory of 4296	3784	svchost.exe	78
PID 3784 wrote to memory of 4296	3784	svchost.exe	78
PID 3784 wrote to memory of 4296	3784	svchost.exe	78
PID 3784 wrote to memory of 204	3784	svchost.exe	79
PID 3784 wrote to memory of 204	3784	svchost.exe	79
PID 3784 wrote to memory of 204	3784	svchost.exe	79
PID 3784 wrote to memory of 204	3784	svchost.exe	79
PID 3784 wrote to memory of 3216	3784	svchost.exe	80
PID 3784 wrote to memory of 3216	3784	svchost.exe	80
PID 3784 wrote to memory of 3216	3784	svchost.exe	80
PID 3784 wrote to memory of 3216	3784	svchost.exe	80
PID 3784 wrote to memory of 3500	3784	svchost.exe	81
PID 3784 wrote to memory of 3500	3784	svchost.exe	81
PID 3784 wrote to memory of 3500	3784	svchost.exe	81
PID 3784 wrote to memory of 3500	3784	svchost.exe	81
PID 3784 wrote to memory of 4552	3784	svchost.exe	82
PID 3784 wrote to memory of 4552	3784	svchost.exe	82
PID 3784 wrote to memory of 4552	3784	svchost.exe	82
PID 3784 wrote to memory of 4552	3784	svchost.exe	82
PID 3784 wrote to memory of 1468	3784	svchost.exe	83
PID 3784 wrote to memory of 1468	3784	svchost.exe	83
PID 3784 wrote to memory of 1468	3784	svchost.exe	83
PID 3784 wrote to memory of 1468	3784	svchost.exe	83
PID 3784 wrote to memory of 4376	3784	svchost.exe	84
PID 3784 wrote to memory of 4376	3784	svchost.exe	84
PID 3784 wrote to memory of 4376	3784	svchost.exe	84
PID 3784 wrote to memory of 4376	3784	svchost.exe	84
PID 3784 wrote to memory of 3356	3784	svchost.exe	85
PID 3784 wrote to memory of 3356	3784	svchost.exe	85
PID 3784 wrote to memory of 3356	3784	svchost.exe	85
PID 3784 wrote to memory of 3356	3784	svchost.exe	85
PID 3784 wrote to memory of 588	3784	svchost.exe	86
PID 3784 wrote to memory of 588	3784	svchost.exe	86
PID 3784 wrote to memory of 588	3784	svchost.exe	86
PID 3784 wrote to memory of 588	3784	svchost.exe	86
PID 3784 wrote to memory of 2160	3784	svchost.exe	88
PID 3784 wrote to memory of 2160	3784	svchost.exe	88
PID 3784 wrote to memory of 2160	3784	svchost.exe	88
PID 3784 wrote to memory of 2160	3784	svchost.exe	88
PID 3784 wrote to memory of 3396	3784	svchost.exe	89
PID 3784 wrote to memory of 3396	3784	svchost.exe	89
PID 3784 wrote to memory of 3396	3784	svchost.exe	89
PID 3784 wrote to memory of 3396	3784	svchost.exe	89
PID 3784 wrote to memory of 3672	3784	svchost.exe	90
PID 3784 wrote to memory of 3672	3784	svchost.exe	90
PID 3784 wrote to memory of 3672	3784	svchost.exe	90
PID 3784 wrote to memory of 3672	3784	svchost.exe	90
PID 3784 wrote to memory of 1656	3784	svchost.exe	91
PID 3784 wrote to memory of 1656	3784	svchost.exe	91
PID 3784 wrote to memory of 1656	3784	svchost.exe	91

C:\Users\Admin\AppData\Local\Temp\Vencord.exe
"C:\Users\Admin\AppData\Local\Temp\Vencord.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\System64\scvhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\SysWOW64\System64\scvhost.exe
      C:\Windows\SysWOW64\System64\scvhost.exe
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\System32\svchost.exe
        5⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3784
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4296
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:204
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3216
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3500
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4552
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1468
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4376
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3356
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:588
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2160
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3396
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3672
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1656
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4624
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2516
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3540
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1688
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4444
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4508
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1196
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3504
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4792
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4240
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2656
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2500
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4420
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4036
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:484
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:508
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:428
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4088
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1588
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3664
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2996
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4184
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2592
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3980
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1352
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3508
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2156
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2180
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1644
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4528
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2504
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2536
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4580
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4492
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1036
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5012
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3636
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4852
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2332
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2972
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1856
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3288
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4120
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1336
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1392
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:196
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2868
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3788
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4708
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1912
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:748
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1508
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3516
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2928
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3376
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5092
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3812
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4556
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1004
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1764
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
402B

MD5
aa3bb02fdbe0aed95d2adf0ef033c2be

SHA1
002f7db7d5e7d368d27d7b1efd1a4f571fac1740

SHA256
d2f9e454aa3a7e614f38219f333420f2ac7963fffafccf3105929c280274de59

SHA512
3a49dfd9d827efdab3abf6220375ba921dde0772bba2b0674ed2562da27853f0df0b786f26c233ca96d8d89c1c95489330c3aea07e62c0b0a6ed716324d8c913

Download Submit
C:\Windows\SysWOW64\System64\scvhost.exe

Filesize
469KB

MD5
e206c8908d5c24a3dda14322807d8e50

SHA1
144d9d69ba30e08dbe79ac3fae47e7c88aedb448

SHA256
00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

SHA512
9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479

Download Submit
memory/204-23-0x0000000002910000-0x000000000298F000-memory.dmp

Filesize
508KB

Download
memory/204-90-0x0000000002910000-0x000000000298F000-memory.dmp

Filesize
508KB

Download
memory/204-28-0x0000000002910000-0x000000000298F000-memory.dmp

Filesize
508KB

Download
memory/204-27-0x0000000002910000-0x000000000298F000-memory.dmp

Filesize
508KB

Download
memory/204-26-0x0000000002910000-0x000000000298F000-memory.dmp

Filesize
508KB

Download
memory/428-203-0x0000000002C90000-0x0000000002D0F000-memory.dmp

Filesize
508KB

Download
memory/484-190-0x0000000003000000-0x000000000307F000-memory.dmp

Filesize
508KB

Download
memory/508-197-0x0000000000260000-0x00000000002DF000-memory.dmp

Filesize
508KB

Download
memory/588-68-0x0000000003250000-0x00000000032CF000-memory.dmp

Filesize
508KB

Download
memory/588-69-0x0000000003250000-0x00000000032CF000-memory.dmp

Filesize
508KB

Download
memory/588-70-0x0000000003250000-0x00000000032CF000-memory.dmp

Filesize
508KB

Download
memory/588-65-0x0000000003250000-0x00000000032CF000-memory.dmp

Filesize
508KB

Download
memory/1036-334-0x0000000000200000-0x000000000027F000-memory.dmp

Filesize
508KB

Download
memory/1196-142-0x00000000002A0000-0x000000000031F000-memory.dmp

Filesize
508KB

Download
memory/1336-398-0x0000000002D70000-0x0000000002DEF000-memory.dmp

Filesize
508KB

Download
memory/1352-264-0x0000000002920000-0x000000000299F000-memory.dmp

Filesize
508KB

Download
memory/1468-50-0x0000000002E70000-0x0000000002EEF000-memory.dmp

Filesize
508KB

Download
memory/1468-47-0x0000000002E70000-0x0000000002EEF000-memory.dmp

Filesize
508KB

Download
memory/1468-51-0x0000000002E70000-0x0000000002EEF000-memory.dmp

Filesize
508KB

Download
memory/1468-52-0x0000000002E70000-0x0000000002EEF000-memory.dmp

Filesize
508KB

Download
memory/1468-117-0x0000000002E70000-0x0000000002EEF000-memory.dmp

Filesize
508KB

Download
memory/1588-217-0x0000000000240000-0x00000000002BF000-memory.dmp

Filesize
508KB

Download
memory/1644-288-0x0000000002C80000-0x0000000002CFF000-memory.dmp

Filesize
508KB

Download
memory/1656-91-0x0000000002970000-0x00000000029EF000-memory.dmp

Filesize
508KB

Download
memory/1656-96-0x0000000002970000-0x00000000029EF000-memory.dmp

Filesize
508KB

Download
memory/1656-94-0x0000000002970000-0x00000000029EF000-memory.dmp

Filesize
508KB

Download
memory/1656-95-0x0000000002970000-0x00000000029EF000-memory.dmp

Filesize
508KB

Download
memory/1688-123-0x0000000002F70000-0x0000000002FEF000-memory.dmp

Filesize
508KB

Download
memory/1688-121-0x0000000002F70000-0x0000000002FEF000-memory.dmp

Filesize
508KB

Download
memory/1688-122-0x0000000002F70000-0x0000000002FEF000-memory.dmp

Filesize
508KB

Download
memory/1688-118-0x0000000002F70000-0x0000000002FEF000-memory.dmp

Filesize
508KB

Download
memory/1856-371-0x0000000002560000-0x00000000025DF000-memory.dmp

Filesize
508KB

Download
memory/2156-276-0x0000000000230000-0x00000000002AF000-memory.dmp

Filesize
508KB

Download
memory/2160-76-0x0000000002D10000-0x0000000002D8F000-memory.dmp

Filesize
508KB

Download
memory/2160-71-0x0000000002D10000-0x0000000002D8F000-memory.dmp

Filesize
508KB

Download
memory/2160-74-0x0000000002D10000-0x0000000002D8F000-memory.dmp

Filesize
508KB

Download
memory/2160-75-0x0000000002D10000-0x0000000002D8F000-memory.dmp

Filesize
508KB

Download
memory/2180-282-0x0000000002C00000-0x0000000002C7F000-memory.dmp

Filesize
508KB

Download
memory/2332-359-0x00000000032D0000-0x000000000334F000-memory.dmp

Filesize
508KB

Download
memory/2500-172-0x0000000002A00000-0x0000000002A7F000-memory.dmp

Filesize
508KB

Download
memory/2504-300-0x0000000002C30000-0x0000000002CAF000-memory.dmp

Filesize
508KB

Download
memory/2516-104-0x0000000003010000-0x000000000308F000-memory.dmp

Filesize
508KB

Download
memory/2516-107-0x0000000003010000-0x000000000308F000-memory.dmp

Filesize
508KB

Download
memory/2516-108-0x0000000003010000-0x000000000308F000-memory.dmp

Filesize
508KB

Download
memory/2516-109-0x0000000003010000-0x000000000308F000-memory.dmp

Filesize
508KB

Download
memory/2536-306-0x0000000003290000-0x000000000330F000-memory.dmp

Filesize
508KB

Download
memory/2592-252-0x0000000000160000-0x00000000001DF000-memory.dmp

Filesize
508KB

Download
memory/2656-166-0x0000000000270000-0x00000000002EF000-memory.dmp

Filesize
508KB

Download
memory/2972-365-0x0000000002AD0000-0x0000000002B4F000-memory.dmp

Filesize
508KB

Download
memory/2996-234-0x0000000003010000-0x000000000308F000-memory.dmp

Filesize
508KB

Download
memory/3216-34-0x0000000003200000-0x000000000327F000-memory.dmp

Filesize
508KB

Download
memory/3216-33-0x0000000003200000-0x000000000327F000-memory.dmp

Filesize
508KB

Download
memory/3216-32-0x0000000003200000-0x000000000327F000-memory.dmp

Filesize
508KB

Download
memory/3216-29-0x0000000003200000-0x000000000327F000-memory.dmp

Filesize
508KB

Download
memory/3216-97-0x0000000003200000-0x000000000327F000-memory.dmp

Filesize
508KB

Download
memory/3288-384-0x0000000002D80000-0x0000000002DFF000-memory.dmp

Filesize
508KB

Download
memory/3356-59-0x0000000002680000-0x00000000026FF000-memory.dmp

Filesize
508KB

Download
memory/3356-64-0x0000000002680000-0x00000000026FF000-memory.dmp

Filesize
508KB

Download
memory/3356-63-0x0000000002680000-0x00000000026FF000-memory.dmp

Filesize
508KB

Download
memory/3356-62-0x0000000002680000-0x00000000026FF000-memory.dmp

Filesize
508KB

Download
memory/3396-81-0x00000000028A0000-0x000000000291F000-memory.dmp

Filesize
508KB

Download
memory/3396-78-0x00000000028A0000-0x000000000291F000-memory.dmp

Filesize
508KB

Download
memory/3396-83-0x00000000028A0000-0x000000000291F000-memory.dmp

Filesize
508KB

Download
memory/3396-82-0x00000000028A0000-0x000000000291F000-memory.dmp

Filesize
508KB

Download
memory/3500-38-0x00000000030C0000-0x000000000313F000-memory.dmp

Filesize
508KB

Download
memory/3500-39-0x00000000030C0000-0x000000000313F000-memory.dmp

Filesize
508KB

Download
memory/3500-40-0x00000000030C0000-0x000000000313F000-memory.dmp

Filesize
508KB

Download
memory/3500-35-0x00000000030C0000-0x000000000313F000-memory.dmp

Filesize
508KB

Download
memory/3504-148-0x0000000002920000-0x000000000299F000-memory.dmp

Filesize
508KB

Download
memory/3508-270-0x0000000002E60000-0x0000000002EDF000-memory.dmp

Filesize
508KB

Download
memory/3540-111-0x00000000026C0000-0x000000000273F000-memory.dmp

Filesize
508KB

Download
memory/3540-116-0x00000000026C0000-0x000000000273F000-memory.dmp

Filesize
508KB

Download
memory/3540-115-0x00000000026C0000-0x000000000273F000-memory.dmp

Filesize
508KB

Download
memory/3540-114-0x00000000026C0000-0x000000000273F000-memory.dmp

Filesize
508KB

Download
memory/3636-346-0x0000000002600000-0x000000000267F000-memory.dmp

Filesize
508KB

Download
memory/3664-228-0x0000000003030000-0x00000000030AF000-memory.dmp

Filesize
508KB

Download
memory/3672-87-0x00000000028A0000-0x000000000291F000-memory.dmp

Filesize
508KB

Download
memory/3672-89-0x00000000028A0000-0x000000000291F000-memory.dmp

Filesize
508KB

Download
memory/3672-88-0x00000000028A0000-0x000000000291F000-memory.dmp

Filesize
508KB

Download
memory/3784-17-0x0000000002A30000-0x0000000002AAF000-memory.dmp

Filesize
508KB

Download
memory/3784-12-0x0000000002A30000-0x0000000002AAF000-memory.dmp

Filesize
508KB

Download
memory/3784-13-0x0000000002A30000-0x0000000002AAF000-memory.dmp

Filesize
508KB

Download
memory/3784-8-0x0000000002A30000-0x0000000002AAF000-memory.dmp

Filesize
508KB

Download
memory/3784-15-0x0000000002A30000-0x0000000002AAF000-memory.dmp

Filesize
508KB

Download
memory/3784-77-0x0000000002A30000-0x0000000002AAF000-memory.dmp

Filesize
508KB

Download
memory/3784-11-0x0000000002A30000-0x0000000002AAF000-memory.dmp

Filesize
508KB

Download
memory/3980-258-0x0000000002A00000-0x0000000002A7F000-memory.dmp

Filesize
508KB

Download
memory/4036-184-0x0000000002A00000-0x0000000002A7F000-memory.dmp

Filesize
508KB

Download
memory/4088-210-0x00000000028D0000-0x000000000294F000-memory.dmp

Filesize
508KB

Download
memory/4120-392-0x00000000030F0000-0x000000000316F000-memory.dmp

Filesize
508KB

Download
memory/4184-245-0x0000000000270000-0x00000000002EF000-memory.dmp

Filesize
508KB

Download
memory/4240-160-0x0000000002F40000-0x0000000002FBF000-memory.dmp

Filesize
508KB

Download
memory/4296-20-0x00000000032B0000-0x000000000332F000-memory.dmp

Filesize
508KB

Download
memory/4296-22-0x00000000032B0000-0x000000000332F000-memory.dmp

Filesize
508KB

Download
memory/4296-21-0x00000000032B0000-0x000000000332F000-memory.dmp

Filesize
508KB

Download
memory/4296-16-0x00000000032B0000-0x000000000332F000-memory.dmp

Filesize
508KB

Download
memory/4376-58-0x0000000002A40000-0x0000000002ABF000-memory.dmp

Filesize
508KB

Download
memory/4376-53-0x0000000002A40000-0x0000000002ABF000-memory.dmp

Filesize
508KB

Download
memory/4376-56-0x0000000002A40000-0x0000000002ABF000-memory.dmp

Filesize
508KB

Download
memory/4376-57-0x0000000002A40000-0x0000000002ABF000-memory.dmp

Filesize
508KB

Download
memory/4376-124-0x0000000002A40000-0x0000000002ABF000-memory.dmp

Filesize
508KB

Download
memory/4420-178-0x0000000002C00000-0x0000000002C7F000-memory.dmp

Filesize
508KB

Download
memory/4444-130-0x0000000002E00000-0x0000000002E7F000-memory.dmp

Filesize
508KB

Download
memory/4444-125-0x0000000002E00000-0x0000000002E7F000-memory.dmp

Filesize
508KB

Download
memory/4444-128-0x0000000002E00000-0x0000000002E7F000-memory.dmp

Filesize
508KB

Download
memory/4444-129-0x0000000002E00000-0x0000000002E7F000-memory.dmp

Filesize
508KB

Download
memory/4444-191-0x0000000002E00000-0x0000000002E7F000-memory.dmp

Filesize
508KB

Download
memory/4492-320-0x0000000002950000-0x00000000029CF000-memory.dmp

Filesize
508KB

Download
memory/4508-135-0x0000000002D20000-0x0000000002D9F000-memory.dmp

Filesize
508KB

Download
memory/4508-134-0x0000000002D20000-0x0000000002D9F000-memory.dmp

Filesize
508KB

Download
memory/4508-131-0x0000000002D20000-0x0000000002D9F000-memory.dmp

Filesize
508KB

Download
memory/4508-136-0x0000000002D20000-0x0000000002D9F000-memory.dmp

Filesize
508KB

Download
memory/4528-294-0x0000000003100000-0x000000000317F000-memory.dmp

Filesize
508KB

Download
memory/4552-45-0x0000000002A60000-0x0000000002ADF000-memory.dmp

Filesize
508KB

Download
memory/4552-41-0x0000000002A60000-0x0000000002ADF000-memory.dmp

Filesize
508KB

Download
memory/4552-46-0x0000000002A60000-0x0000000002ADF000-memory.dmp

Filesize
508KB

Download
memory/4552-44-0x0000000002A60000-0x0000000002ADF000-memory.dmp

Filesize
508KB

Download
memory/4552-110-0x0000000002A60000-0x0000000002ADF000-memory.dmp

Filesize
508KB

Download
memory/4580-312-0x0000000002890000-0x000000000290F000-memory.dmp

Filesize
508KB

Download
memory/4624-103-0x0000000003200000-0x000000000327F000-memory.dmp

Filesize
508KB

Download
memory/4624-102-0x0000000003200000-0x000000000327F000-memory.dmp

Filesize
508KB

Download
memory/4624-101-0x0000000003200000-0x000000000327F000-memory.dmp

Filesize
508KB

Download
memory/4792-154-0x0000000002650000-0x00000000026CF000-memory.dmp

Filesize
508KB

Download
memory/4852-352-0x00000000001E0000-0x000000000025F000-memory.dmp

Filesize
508KB

Download
memory/5012-340-0x0000000000190000-0x000000000020F000-memory.dmp

Filesize
508KB

Download