remcos | 00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

Resubmissions

21-03-2024 08:04

240321-jydgaagd5x 10

13-03-2024 17:04

240313-vlgtqaad4y 10

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
13-03-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vencord.exe
Size

469KB
MD5

e206c8908d5c24a3dda14322807d8e50
SHA1

144d9d69ba30e08dbe79ac3fae47e7c88aedb448
SHA256

00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e
SHA512

9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS5n9:uiLJbpI7I2WhQqZ759

Score

10^/10

remcos vencord persistence rat

Malware Config

Extracted

Family

remcos

Botnet

VenCord

147.185.221.18:52136

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
scvhost.exe
copy_folder
System64
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
yh?0J?xxu¢iw)>zqn*'^?^^_wh+ru?*&~2yzwL\"s?>yhi)?0J?xxuz,-QZL639
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
DiscordUpdate
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe

Executes dropped EXE 1 IoCs

pid	Process
2080	scvhost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe
File opened for modification	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 1264	2080	scvhost.exe	85
PID 1264 set thread context of 3136	1264	iexplore.exe	86
PID 1264 set thread context of 4952	1264	iexplore.exe	87
PID 1264 set thread context of 3692	1264	iexplore.exe	88
PID 1264 set thread context of 1224	1264	iexplore.exe	89
PID 1264 set thread context of 1868	1264	iexplore.exe	90
PID 1264 set thread context of 4188	1264	iexplore.exe	91
PID 1264 set thread context of 468	1264	iexplore.exe	92
PID 1264 set thread context of 3640	1264	iexplore.exe	93
PID 1264 set thread context of 1572	1264	iexplore.exe	94
PID 1264 set thread context of 3892	1264	iexplore.exe	95
PID 1264 set thread context of 2056	1264	iexplore.exe	96
PID 1264 set thread context of 3508	1264	iexplore.exe	97
PID 1264 set thread context of 2168	1264	iexplore.exe	98
PID 1264 set thread context of 4056	1264	iexplore.exe	100
PID 1264 set thread context of 2188	1264	iexplore.exe	101
PID 1264 set thread context of 2676	1264	iexplore.exe	102
PID 1264 set thread context of 3456	1264	iexplore.exe	103
PID 1264 set thread context of 3364	1264	iexplore.exe	104
PID 1264 set thread context of 4824	1264	iexplore.exe	105
PID 1264 set thread context of 2944	1264	iexplore.exe	106
PID 1264 set thread context of 1436	1264	iexplore.exe	107
PID 1264 set thread context of 4480	1264	iexplore.exe	108
PID 1264 set thread context of 4988	1264	iexplore.exe	109
PID 1264 set thread context of 2720	1264	iexplore.exe	110
PID 1264 set thread context of 1904	1264	iexplore.exe	111
PID 1264 set thread context of 1060	1264	iexplore.exe	112
PID 1264 set thread context of 764	1264	iexplore.exe	113
PID 1264 set thread context of 2428	1264	iexplore.exe	114
PID 1264 set thread context of 2052	1264	iexplore.exe	115
PID 1264 set thread context of 4804	1264	iexplore.exe	116
PID 1264 set thread context of 4912	1264	iexplore.exe	117
PID 1264 set thread context of 2080	1264	iexplore.exe	118
PID 1264 set thread context of 4552	1264	iexplore.exe	119
PID 1264 set thread context of 344	1264	iexplore.exe	120
PID 1264 set thread context of 3688	1264	iexplore.exe	121
PID 1264 set thread context of 4896	1264	iexplore.exe	122
PID 1264 set thread context of 4252	1264	iexplore.exe	123
PID 1264 set thread context of 2288	1264	iexplore.exe	124
PID 1264 set thread context of 1496	1264	iexplore.exe	125
PID 1264 set thread context of 768	1264	iexplore.exe	126
PID 1264 set thread context of 3592	1264	iexplore.exe	127
PID 1264 set thread context of 2440	1264	iexplore.exe	128
PID 1264 set thread context of 4556	1264	iexplore.exe	129
PID 1264 set thread context of 2820	1264	iexplore.exe	130
PID 1264 set thread context of 3832	1264	iexplore.exe	131
PID 1264 set thread context of 4708	1264	iexplore.exe	132
PID 1264 set thread context of 928	1264	iexplore.exe	133
PID 1264 set thread context of 2036	1264	iexplore.exe	134
PID 1264 set thread context of 564	1264	iexplore.exe	135
PID 1264 set thread context of 3672	1264	iexplore.exe	136
PID 1264 set thread context of 2244	1264	iexplore.exe	137
PID 1264 set thread context of 1548	1264	iexplore.exe	138
PID 1264 set thread context of 4492	1264	iexplore.exe	139
PID 1264 set thread context of 2540	1264	iexplore.exe	140
PID 1264 set thread context of 3400	1264	iexplore.exe	141
PID 1264 set thread context of 4084	1264	iexplore.exe	142
PID 1264 set thread context of 3488	1264	iexplore.exe	143
PID 1264 set thread context of 1088	1264	iexplore.exe	144
PID 1264 set thread context of 428	1264	iexplore.exe	145
PID 1264 set thread context of 5044	1264	iexplore.exe	146
PID 1264 set thread context of 4616	1264	iexplore.exe	147
PID 1264 set thread context of 1084	1264	iexplore.exe	148
PID 1264 set thread context of 4048	1264	iexplore.exe	149

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000_Classes\Local Settings	Vencord.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	scvhost.exe
2080	scvhost.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2080	scvhost.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe
1264	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3132	4968	Vencord.exe	79
PID 4968 wrote to memory of 3132	4968	Vencord.exe	79
PID 4968 wrote to memory of 3132	4968	Vencord.exe	79
PID 3132 wrote to memory of 224	3132	WScript.exe	82
PID 3132 wrote to memory of 224	3132	WScript.exe	82
PID 3132 wrote to memory of 224	3132	WScript.exe	82
PID 224 wrote to memory of 2080	224	cmd.exe	84
PID 224 wrote to memory of 2080	224	cmd.exe	84
PID 224 wrote to memory of 2080	224	cmd.exe	84
PID 2080 wrote to memory of 1264	2080	scvhost.exe	85
PID 2080 wrote to memory of 1264	2080	scvhost.exe	85
PID 2080 wrote to memory of 1264	2080	scvhost.exe	85
PID 2080 wrote to memory of 1264	2080	scvhost.exe	85
PID 1264 wrote to memory of 3136	1264	iexplore.exe	86
PID 1264 wrote to memory of 3136	1264	iexplore.exe	86
PID 1264 wrote to memory of 3136	1264	iexplore.exe	86
PID 1264 wrote to memory of 3136	1264	iexplore.exe	86
PID 1264 wrote to memory of 4952	1264	iexplore.exe	87
PID 1264 wrote to memory of 4952	1264	iexplore.exe	87
PID 1264 wrote to memory of 4952	1264	iexplore.exe	87
PID 1264 wrote to memory of 4952	1264	iexplore.exe	87
PID 1264 wrote to memory of 3692	1264	iexplore.exe	88
PID 1264 wrote to memory of 3692	1264	iexplore.exe	88
PID 1264 wrote to memory of 3692	1264	iexplore.exe	88
PID 1264 wrote to memory of 3692	1264	iexplore.exe	88
PID 1264 wrote to memory of 1224	1264	iexplore.exe	89
PID 1264 wrote to memory of 1224	1264	iexplore.exe	89
PID 1264 wrote to memory of 1224	1264	iexplore.exe	89
PID 1264 wrote to memory of 1224	1264	iexplore.exe	89
PID 1264 wrote to memory of 1868	1264	iexplore.exe	90
PID 1264 wrote to memory of 1868	1264	iexplore.exe	90
PID 1264 wrote to memory of 1868	1264	iexplore.exe	90
PID 1264 wrote to memory of 1868	1264	iexplore.exe	90
PID 1264 wrote to memory of 4188	1264	iexplore.exe	91
PID 1264 wrote to memory of 4188	1264	iexplore.exe	91
PID 1264 wrote to memory of 4188	1264	iexplore.exe	91
PID 1264 wrote to memory of 4188	1264	iexplore.exe	91
PID 1264 wrote to memory of 468	1264	iexplore.exe	92
PID 1264 wrote to memory of 468	1264	iexplore.exe	92
PID 1264 wrote to memory of 468	1264	iexplore.exe	92
PID 1264 wrote to memory of 468	1264	iexplore.exe	92
PID 1264 wrote to memory of 3640	1264	iexplore.exe	93
PID 1264 wrote to memory of 3640	1264	iexplore.exe	93
PID 1264 wrote to memory of 3640	1264	iexplore.exe	93
PID 1264 wrote to memory of 3640	1264	iexplore.exe	93
PID 1264 wrote to memory of 1572	1264	iexplore.exe	94
PID 1264 wrote to memory of 1572	1264	iexplore.exe	94
PID 1264 wrote to memory of 1572	1264	iexplore.exe	94
PID 1264 wrote to memory of 1572	1264	iexplore.exe	94
PID 1264 wrote to memory of 3892	1264	iexplore.exe	95
PID 1264 wrote to memory of 3892	1264	iexplore.exe	95
PID 1264 wrote to memory of 3892	1264	iexplore.exe	95
PID 1264 wrote to memory of 3892	1264	iexplore.exe	95
PID 1264 wrote to memory of 2056	1264	iexplore.exe	96
PID 1264 wrote to memory of 2056	1264	iexplore.exe	96
PID 1264 wrote to memory of 2056	1264	iexplore.exe	96
PID 1264 wrote to memory of 2056	1264	iexplore.exe	96
PID 1264 wrote to memory of 3508	1264	iexplore.exe	97
PID 1264 wrote to memory of 3508	1264	iexplore.exe	97
PID 1264 wrote to memory of 3508	1264	iexplore.exe	97
PID 1264 wrote to memory of 3508	1264	iexplore.exe	97
PID 1264 wrote to memory of 2168	1264	iexplore.exe	98
PID 1264 wrote to memory of 2168	1264	iexplore.exe	98
PID 1264 wrote to memory of 2168	1264	iexplore.exe	98

C:\Users\Admin\AppData\Local\Temp\Vencord.exe
"C:\Users\Admin\AppData\Local\Temp\Vencord.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\System64\scvhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\SysWOW64\System64\scvhost.exe
      C:\Windows\SysWOW64\System64\scvhost.exe
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2080
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1264
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3136
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4952
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3692
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1224
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1868
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4188
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:468
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3640
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1572
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3892
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2056
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3508
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2168
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4056
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2188
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2676
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3456
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3364
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4824
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2944
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1436
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4480
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4988
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2720
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1904
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1060
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:764
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2428
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2052
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4804
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4912
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2080
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4552
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:344
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3688
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4896
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4252
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2288
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1496
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:768
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3592
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2440
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4556
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2820
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3832
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4708
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:928
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2036
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:564
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3672
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2244
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1548
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4492
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2540
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3400
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4084
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3488
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1088
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:428
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5044
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4616
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1084
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4048
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4724
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4372
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2656
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:228
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1848
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3384
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3132
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4040
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1684
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2752
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
402B

MD5
aa3bb02fdbe0aed95d2adf0ef033c2be

SHA1
002f7db7d5e7d368d27d7b1efd1a4f571fac1740

SHA256
d2f9e454aa3a7e614f38219f333420f2ac7963fffafccf3105929c280274de59

SHA512
3a49dfd9d827efdab3abf6220375ba921dde0772bba2b0674ed2562da27853f0df0b786f26c233ca96d8d89c1c95489330c3aea07e62c0b0a6ed716324d8c913

Download Submit
C:\Windows\SysWOW64\System64\scvhost.exe

Filesize
469KB

MD5
e206c8908d5c24a3dda14322807d8e50

SHA1
144d9d69ba30e08dbe79ac3fae47e7c88aedb448

SHA256
00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

SHA512
9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479

Download Submit
memory/344-172-0x0000000000C50000-0x0000000000CCF000-memory.dmp

Filesize
508KB

Download
memory/428-304-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/468-43-0x0000000000500000-0x000000000057F000-memory.dmp

Filesize
508KB

Download
memory/468-40-0x0000000000500000-0x000000000057F000-memory.dmp

Filesize
508KB

Download
memory/468-41-0x0000000000500000-0x000000000057F000-memory.dmp

Filesize
508KB

Download
memory/468-42-0x0000000000500000-0x000000000057F000-memory.dmp

Filesize
508KB

Download
memory/564-250-0x0000000001000000-0x000000000107F000-memory.dmp

Filesize
508KB

Download
memory/764-138-0x0000000000CF0000-0x0000000000D6F000-memory.dmp

Filesize
508KB

Download
memory/768-203-0x0000000000CE0000-0x0000000000D5F000-memory.dmp

Filesize
508KB

Download
memory/928-236-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/1060-132-0x00000000010F0000-0x000000000116F000-memory.dmp

Filesize
508KB

Download
memory/1088-300-0x0000000000160000-0x00000000001DF000-memory.dmp

Filesize
508KB

Download
memory/1224-28-0x0000000000F80000-0x0000000000FFF000-memory.dmp

Filesize
508KB

Download
memory/1224-29-0x0000000000F80000-0x0000000000FFF000-memory.dmp

Filesize
508KB

Download
memory/1224-30-0x0000000000F80000-0x0000000000FFF000-memory.dmp

Filesize
508KB

Download
memory/1224-31-0x0000000000F80000-0x0000000000FFF000-memory.dmp

Filesize
508KB

Download
memory/1264-8-0x00000000001E0000-0x000000000025F000-memory.dmp

Filesize
508KB

Download
memory/1264-9-0x00000000001E0000-0x000000000025F000-memory.dmp

Filesize
508KB

Download
memory/1264-15-0x00000000001E0000-0x000000000025F000-memory.dmp

Filesize
508KB

Download
memory/1264-10-0x00000000001E0000-0x000000000025F000-memory.dmp

Filesize
508KB

Download
memory/1264-56-0x00000000001E0000-0x000000000025F000-memory.dmp

Filesize
508KB

Download
memory/1264-12-0x00000000001E0000-0x000000000025F000-memory.dmp

Filesize
508KB

Download
memory/1264-14-0x00000000001E0000-0x000000000025F000-memory.dmp

Filesize
508KB

Download
memory/1436-107-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/1496-199-0x0000000000F40000-0x0000000000FBF000-memory.dmp

Filesize
508KB

Download
memory/1548-268-0x0000000000D50000-0x0000000000DCF000-memory.dmp

Filesize
508KB

Download
memory/1572-51-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/1572-49-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/1572-48-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/1572-50-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/1868-35-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/1868-33-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/1868-32-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/1868-34-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/1904-182-0x0000000000D60000-0x0000000000DDF000-memory.dmp

Filesize
508KB

Download
memory/1904-128-0x0000000000D60000-0x0000000000DDF000-memory.dmp

Filesize
508KB

Download
memory/2036-244-0x0000000000460000-0x00000000004DF000-memory.dmp

Filesize
508KB

Download
memory/2052-148-0x0000000000600000-0x000000000067F000-memory.dmp

Filesize
508KB

Download
memory/2056-58-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/2056-59-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/2056-60-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/2080-160-0x0000000000EB0000-0x0000000000F2F000-memory.dmp

Filesize
508KB

Download
memory/2168-68-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2168-66-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2168-67-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2168-65-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2188-76-0x0000000000600000-0x000000000067F000-memory.dmp

Filesize
508KB

Download
memory/2188-75-0x0000000000600000-0x000000000067F000-memory.dmp

Filesize
508KB

Download
memory/2188-74-0x0000000000600000-0x000000000067F000-memory.dmp

Filesize
508KB

Download
memory/2188-73-0x0000000000600000-0x000000000067F000-memory.dmp

Filesize
508KB

Download
memory/2244-260-0x0000000000B60000-0x0000000000BDF000-memory.dmp

Filesize
508KB

Download
memory/2288-194-0x0000000001230000-0x00000000012AF000-memory.dmp

Filesize
508KB

Download
memory/2428-142-0x0000000000380000-0x00000000003FF000-memory.dmp

Filesize
508KB

Download
memory/2440-212-0x0000000001280000-0x00000000012FF000-memory.dmp

Filesize
508KB

Download
memory/2540-276-0x00000000010A0000-0x000000000111F000-memory.dmp

Filesize
508KB

Download
memory/2676-79-0x0000000000B80000-0x0000000000BFF000-memory.dmp

Filesize
508KB

Download
memory/2676-80-0x0000000000B80000-0x0000000000BFF000-memory.dmp

Filesize
508KB

Download
memory/2676-78-0x0000000000B80000-0x0000000000BFF000-memory.dmp

Filesize
508KB

Download
memory/2720-124-0x0000000000410000-0x000000000048F000-memory.dmp

Filesize
508KB

Download
memory/2820-220-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/2944-101-0x0000000000F20000-0x0000000000F9F000-memory.dmp

Filesize
508KB

Download
memory/3136-18-0x0000000000B80000-0x0000000000BFF000-memory.dmp

Filesize
508KB

Download
memory/3136-16-0x0000000000B80000-0x0000000000BFF000-memory.dmp

Filesize
508KB

Download
memory/3136-17-0x0000000000B80000-0x0000000000BFF000-memory.dmp

Filesize
508KB

Download
memory/3136-19-0x0000000000B80000-0x0000000000BFF000-memory.dmp

Filesize
508KB

Download
memory/3364-88-0x00000000010F0000-0x000000000116F000-memory.dmp

Filesize
508KB

Download
memory/3364-143-0x00000000010F0000-0x000000000116F000-memory.dmp

Filesize
508KB

Download
memory/3364-85-0x00000000010F0000-0x000000000116F000-memory.dmp

Filesize
508KB

Download
memory/3364-86-0x00000000010F0000-0x000000000116F000-memory.dmp

Filesize
508KB

Download
memory/3364-87-0x00000000010F0000-0x000000000116F000-memory.dmp

Filesize
508KB

Download
memory/3400-287-0x0000000000960000-0x00000000009DF000-memory.dmp

Filesize
508KB

Download
memory/3456-81-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3456-82-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3456-83-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3456-84-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3488-295-0x0000000000D20000-0x0000000000D9F000-memory.dmp

Filesize
508KB

Download
memory/3508-63-0x0000000000310000-0x000000000038F000-memory.dmp

Filesize
508KB

Download
memory/3508-62-0x0000000000310000-0x000000000038F000-memory.dmp

Filesize
508KB

Download
memory/3508-61-0x0000000000310000-0x000000000038F000-memory.dmp

Filesize
508KB

Download
memory/3508-64-0x0000000000310000-0x000000000038F000-memory.dmp

Filesize
508KB

Download
memory/3592-208-0x0000000000850000-0x00000000008CF000-memory.dmp

Filesize
508KB

Download
memory/3640-47-0x0000000000F00000-0x0000000000F7F000-memory.dmp

Filesize
508KB

Download
memory/3640-44-0x0000000000F00000-0x0000000000F7F000-memory.dmp

Filesize
508KB

Download
memory/3640-46-0x0000000000F00000-0x0000000000F7F000-memory.dmp

Filesize
508KB

Download
memory/3640-45-0x0000000000F00000-0x0000000000F7F000-memory.dmp

Filesize
508KB

Download
memory/3672-256-0x0000000000D70000-0x0000000000DEF000-memory.dmp

Filesize
508KB

Download
memory/3688-181-0x0000000000430000-0x00000000004AF000-memory.dmp

Filesize
508KB

Download
memory/3692-27-0x0000000000C20000-0x0000000000C9F000-memory.dmp

Filesize
508KB

Download
memory/3692-25-0x0000000000C20000-0x0000000000C9F000-memory.dmp

Filesize
508KB

Download
memory/3692-24-0x0000000000C20000-0x0000000000C9F000-memory.dmp

Filesize
508KB

Download
memory/3692-26-0x0000000000C20000-0x0000000000C9F000-memory.dmp

Filesize
508KB

Download
memory/3832-224-0x0000000000520000-0x000000000059F000-memory.dmp

Filesize
508KB

Download
memory/3892-55-0x0000000000780000-0x00000000007FF000-memory.dmp

Filesize
508KB

Download
memory/3892-52-0x0000000000780000-0x00000000007FF000-memory.dmp

Filesize
508KB

Download
memory/3892-53-0x0000000000780000-0x00000000007FF000-memory.dmp

Filesize
508KB

Download
memory/3892-54-0x0000000000780000-0x00000000007FF000-memory.dmp

Filesize
508KB

Download
memory/4056-71-0x0000000001050000-0x00000000010CF000-memory.dmp

Filesize
508KB

Download
memory/4056-72-0x0000000001050000-0x00000000010CF000-memory.dmp

Filesize
508KB

Download
memory/4056-69-0x0000000001050000-0x00000000010CF000-memory.dmp

Filesize
508KB

Download
memory/4056-70-0x0000000001050000-0x00000000010CF000-memory.dmp

Filesize
508KB

Download
memory/4084-291-0x0000000000D60000-0x0000000000DDF000-memory.dmp

Filesize
508KB

Download
memory/4188-36-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4188-37-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4188-38-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4188-39-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4252-190-0x0000000000850000-0x00000000008CF000-memory.dmp

Filesize
508KB

Download
memory/4480-111-0x0000000000F60000-0x0000000000FDF000-memory.dmp

Filesize
508KB

Download
memory/4492-272-0x0000000000F40000-0x0000000000FBF000-memory.dmp

Filesize
508KB

Download
memory/4552-164-0x0000000001040000-0x00000000010BF000-memory.dmp

Filesize
508KB

Download
memory/4556-216-0x00000000006E0000-0x000000000075F000-memory.dmp

Filesize
508KB

Download
memory/4708-228-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4804-204-0x00000000006C0000-0x000000000073F000-memory.dmp

Filesize
508KB

Download
memory/4804-152-0x00000000006C0000-0x000000000073F000-memory.dmp

Filesize
508KB

Download
memory/4824-90-0x0000000000D50000-0x0000000000DCF000-memory.dmp

Filesize
508KB

Download
memory/4824-89-0x0000000000D50000-0x0000000000DCF000-memory.dmp

Filesize
508KB

Download
memory/4824-91-0x0000000000D50000-0x0000000000DCF000-memory.dmp

Filesize
508KB

Download
memory/4824-92-0x0000000000D50000-0x0000000000DCF000-memory.dmp

Filesize
508KB

Download
memory/4896-186-0x0000000000650000-0x00000000006CF000-memory.dmp

Filesize
508KB

Download
memory/4912-156-0x0000000000A00000-0x0000000000A7F000-memory.dmp

Filesize
508KB

Download
memory/4952-23-0x0000000000A00000-0x0000000000A7F000-memory.dmp

Filesize
508KB

Download
memory/4952-22-0x0000000000A00000-0x0000000000A7F000-memory.dmp

Filesize
508KB

Download
memory/4952-21-0x0000000000A00000-0x0000000000A7F000-memory.dmp

Filesize
508KB

Download
memory/4952-20-0x0000000000A00000-0x0000000000A7F000-memory.dmp

Filesize
508KB

Download
memory/4988-117-0x0000000000480000-0x00000000004FF000-memory.dmp

Filesize
508KB

Download