remcos | 00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

Resubmissions

21-03-2024 08:04

240321-jydgaagd5x 10

13-03-2024 17:04

240313-vlgtqaad4y 10

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-03-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vencord.exe
Size

469KB
MD5

e206c8908d5c24a3dda14322807d8e50
SHA1

144d9d69ba30e08dbe79ac3fae47e7c88aedb448
SHA256

00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e
SHA512

9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS5n9:uiLJbpI7I2WhQqZ759

Score

10^/10

remcos vencord persistence rat

Malware Config

Extracted

Family

remcos

Botnet

VenCord

147.185.221.18:52136

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
scvhost.exe
copy_folder
System64
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
yh?0J?xxu¢iw)>zqn*'^?^^_wh+ru?*&~2yzwL\"s?>yhi)?0J?xxuz,-QZL639
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
DiscordUpdate
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe

Executes dropped EXE 1 IoCs

pid	Process
2564	scvhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2580	cmd.exe
2580	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe
File opened for modification	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 2984	2564	scvhost.exe	32
PID 2984 set thread context of 2532	2984	iexplore.exe	33
PID 2984 set thread context of 2544	2984	iexplore.exe	34
PID 2984 set thread context of 2436	2984	iexplore.exe	35
PID 2984 set thread context of 2932	2984	iexplore.exe	36
PID 2984 set thread context of 2904	2984	iexplore.exe	37
PID 2984 set thread context of 2616	2984	iexplore.exe	38
PID 2984 set thread context of 2632	2984	iexplore.exe	39
PID 2984 set thread context of 2772	2984	iexplore.exe	40
PID 2984 set thread context of 2728	2984	iexplore.exe	41
PID 2984 set thread context of 2140	2984	iexplore.exe	42
PID 2984 set thread context of 1648	2984	iexplore.exe	43
PID 2984 set thread context of 1728	2984	iexplore.exe	44
PID 2984 set thread context of 2260	2984	iexplore.exe	45
PID 2984 set thread context of 2360	2984	iexplore.exe	46
PID 2984 set thread context of 2152	2984	iexplore.exe	47
PID 2984 set thread context of 1612	2984	iexplore.exe	48
PID 2984 set thread context of 3040	2984	iexplore.exe	49
PID 2984 set thread context of 2792	2984	iexplore.exe	50
PID 2984 set thread context of 1668	2984	iexplore.exe	51
PID 2984 set thread context of 2592	2984	iexplore.exe	52
PID 2984 set thread context of 2064	2984	iexplore.exe	53
PID 2984 set thread context of 696	2984	iexplore.exe	54
PID 2984 set thread context of 596	2984	iexplore.exe	55
PID 2984 set thread context of 276	2984	iexplore.exe	58
PID 2984 set thread context of 3004	2984	iexplore.exe	59
PID 2984 set thread context of 2104	2984	iexplore.exe	60
PID 2984 set thread context of 1432	2984	iexplore.exe	61
PID 2984 set thread context of 1608	2984	iexplore.exe	62
PID 2984 set thread context of 1552	2984	iexplore.exe	63
PID 2984 set thread context of 1592	2984	iexplore.exe	64
PID 2984 set thread context of 1012	2984	iexplore.exe	65
PID 2984 set thread context of 2292	2984	iexplore.exe	66
PID 2984 set thread context of 1952	2984	iexplore.exe	67
PID 2984 set thread context of 1272	2984	iexplore.exe	68
PID 2984 set thread context of 2052	2984	iexplore.exe	69
PID 2984 set thread context of 1440	2984	iexplore.exe	70
PID 2984 set thread context of 1744	2984	iexplore.exe	71
PID 2984 set thread context of 2164	2984	iexplore.exe	72
PID 2984 set thread context of 1536	2984	iexplore.exe	73
PID 2984 set thread context of 2704	2984	iexplore.exe	74
PID 2984 set thread context of 2576	2984	iexplore.exe	75
PID 2984 set thread context of 3008	2984	iexplore.exe	76
PID 2984 set thread context of 2656	2984	iexplore.exe	77
PID 2984 set thread context of 2408	2984	iexplore.exe	78
PID 2984 set thread context of 2384	2984	iexplore.exe	79
PID 2984 set thread context of 780	2984	iexplore.exe	80
PID 2984 set thread context of 2888	2984	iexplore.exe	81
PID 2984 set thread context of 2424	2984	iexplore.exe	82
PID 2984 set thread context of 2588	2984	iexplore.exe	83
PID 2984 set thread context of 2788	2984	iexplore.exe	84
PID 2984 set thread context of 2712	2984	iexplore.exe	85
PID 2984 set thread context of 860	2984	iexplore.exe	86
PID 2984 set thread context of 1916	2984	iexplore.exe	87
PID 2984 set thread context of 1936	2984	iexplore.exe	88
PID 2984 set thread context of 1932	2984	iexplore.exe	89
PID 2984 set thread context of 2144	2984	iexplore.exe	90
PID 2984 set thread context of 1456	2984	iexplore.exe	91
PID 2984 set thread context of 1708	2984	iexplore.exe	92
PID 2984 set thread context of 2216	2984	iexplore.exe	93
PID 2984 set thread context of 1856	2984	iexplore.exe	94
PID 2984 set thread context of 600	2984	iexplore.exe	95
PID 2984 set thread context of 592	2984	iexplore.exe	96
PID 2984 set thread context of 2240	2984	iexplore.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2564	scvhost.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2564	scvhost.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe
2984	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2464	1028	Vencord.exe	28
PID 1028 wrote to memory of 2464	1028	Vencord.exe	28
PID 1028 wrote to memory of 2464	1028	Vencord.exe	28
PID 1028 wrote to memory of 2464	1028	Vencord.exe	28
PID 2464 wrote to memory of 2580	2464	WScript.exe	29
PID 2464 wrote to memory of 2580	2464	WScript.exe	29
PID 2464 wrote to memory of 2580	2464	WScript.exe	29
PID 2464 wrote to memory of 2580	2464	WScript.exe	29
PID 2580 wrote to memory of 2564	2580	cmd.exe	31
PID 2580 wrote to memory of 2564	2580	cmd.exe	31
PID 2580 wrote to memory of 2564	2580	cmd.exe	31
PID 2580 wrote to memory of 2564	2580	cmd.exe	31
PID 2564 wrote to memory of 2984	2564	scvhost.exe	32
PID 2564 wrote to memory of 2984	2564	scvhost.exe	32
PID 2564 wrote to memory of 2984	2564	scvhost.exe	32
PID 2564 wrote to memory of 2984	2564	scvhost.exe	32
PID 2564 wrote to memory of 2984	2564	scvhost.exe	32
PID 2984 wrote to memory of 2532	2984	iexplore.exe	33
PID 2984 wrote to memory of 2532	2984	iexplore.exe	33
PID 2984 wrote to memory of 2532	2984	iexplore.exe	33
PID 2984 wrote to memory of 2532	2984	iexplore.exe	33
PID 2984 wrote to memory of 2532	2984	iexplore.exe	33
PID 2984 wrote to memory of 2544	2984	iexplore.exe	34
PID 2984 wrote to memory of 2544	2984	iexplore.exe	34
PID 2984 wrote to memory of 2544	2984	iexplore.exe	34
PID 2984 wrote to memory of 2544	2984	iexplore.exe	34
PID 2984 wrote to memory of 2544	2984	iexplore.exe	34
PID 2984 wrote to memory of 2436	2984	iexplore.exe	35
PID 2984 wrote to memory of 2436	2984	iexplore.exe	35
PID 2984 wrote to memory of 2436	2984	iexplore.exe	35
PID 2984 wrote to memory of 2436	2984	iexplore.exe	35
PID 2984 wrote to memory of 2436	2984	iexplore.exe	35
PID 2984 wrote to memory of 2932	2984	iexplore.exe	36
PID 2984 wrote to memory of 2932	2984	iexplore.exe	36
PID 2984 wrote to memory of 2932	2984	iexplore.exe	36
PID 2984 wrote to memory of 2932	2984	iexplore.exe	36
PID 2984 wrote to memory of 2932	2984	iexplore.exe	36
PID 2984 wrote to memory of 2904	2984	iexplore.exe	37
PID 2984 wrote to memory of 2904	2984	iexplore.exe	37
PID 2984 wrote to memory of 2904	2984	iexplore.exe	37
PID 2984 wrote to memory of 2904	2984	iexplore.exe	37
PID 2984 wrote to memory of 2904	2984	iexplore.exe	37
PID 2984 wrote to memory of 2616	2984	iexplore.exe	38
PID 2984 wrote to memory of 2616	2984	iexplore.exe	38
PID 2984 wrote to memory of 2616	2984	iexplore.exe	38
PID 2984 wrote to memory of 2616	2984	iexplore.exe	38
PID 2984 wrote to memory of 2616	2984	iexplore.exe	38
PID 2984 wrote to memory of 2632	2984	iexplore.exe	39
PID 2984 wrote to memory of 2632	2984	iexplore.exe	39
PID 2984 wrote to memory of 2632	2984	iexplore.exe	39
PID 2984 wrote to memory of 2632	2984	iexplore.exe	39
PID 2984 wrote to memory of 2632	2984	iexplore.exe	39
PID 2984 wrote to memory of 2772	2984	iexplore.exe	40
PID 2984 wrote to memory of 2772	2984	iexplore.exe	40
PID 2984 wrote to memory of 2772	2984	iexplore.exe	40
PID 2984 wrote to memory of 2772	2984	iexplore.exe	40
PID 2984 wrote to memory of 2772	2984	iexplore.exe	40
PID 2984 wrote to memory of 2728	2984	iexplore.exe	41
PID 2984 wrote to memory of 2728	2984	iexplore.exe	41
PID 2984 wrote to memory of 2728	2984	iexplore.exe	41
PID 2984 wrote to memory of 2728	2984	iexplore.exe	41
PID 2984 wrote to memory of 2728	2984	iexplore.exe	41
PID 2984 wrote to memory of 2140	2984	iexplore.exe	42
PID 2984 wrote to memory of 2140	2984	iexplore.exe	42

C:\Users\Admin\AppData\Local\Temp\Vencord.exe
"C:\Users\Admin\AppData\Local\Temp\Vencord.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\System64\scvhost.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SysWOW64\System64\scvhost.exe
      C:\Windows\SysWOW64\System64\scvhost.exe
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2564
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2984
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2532
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2544
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2436
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2932
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2904
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2616
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2632
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2772
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2728
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2140
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1648
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1728
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2260
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2360
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2152
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1612
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3040
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2792
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1668
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2592
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2064
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:696
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:596
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:276
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3004
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2104
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1432
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1608
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1552
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1592
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1012
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2292
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1952
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1272
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2052
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1440
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1744
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2164
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1536
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2704
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2576
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3008
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2656
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2408
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2384
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:780
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2888
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2424
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2588
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2788
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2712
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:860
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1916
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1936
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1932
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2144
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1456
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1708
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2216
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1856
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:600
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:592
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2240
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:452
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2080
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2000
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2184
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:580
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:920
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1052
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2328
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3028
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1628
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
402B

MD5
aa3bb02fdbe0aed95d2adf0ef033c2be

SHA1
002f7db7d5e7d368d27d7b1efd1a4f571fac1740

SHA256
d2f9e454aa3a7e614f38219f333420f2ac7963fffafccf3105929c280274de59

SHA512
3a49dfd9d827efdab3abf6220375ba921dde0772bba2b0674ed2562da27853f0df0b786f26c233ca96d8d89c1c95489330c3aea07e62c0b0a6ed716324d8c913

Download Submit
\Windows\SysWOW64\System64\scvhost.exe

Filesize
469KB

MD5
e206c8908d5c24a3dda14322807d8e50

SHA1
144d9d69ba30e08dbe79ac3fae47e7c88aedb448

SHA256
00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

SHA512
9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479

Download Submit
memory/276-167-0x00000000000F0000-0x000000000016F000-memory.dmp

Filesize
508KB

Download
memory/592-401-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/596-161-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/600-395-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/696-153-0x0000000000090000-0x000000000010F000-memory.dmp

Filesize
508KB

Download
memory/780-303-0x0000000000130000-0x00000000001AF000-memory.dmp

Filesize
508KB

Download
memory/860-339-0x00000000000F0000-0x000000000016F000-memory.dmp

Filesize
508KB

Download
memory/1012-209-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/1272-229-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/1432-185-0x0000000000150000-0x00000000001CF000-memory.dmp

Filesize
508KB

Download
memory/1440-241-0x00000000000D0000-0x000000000014F000-memory.dmp

Filesize
508KB

Download
memory/1456-371-0x0000000000170000-0x00000000001EF000-memory.dmp

Filesize
508KB

Download
memory/1536-259-0x0000000000110000-0x000000000018F000-memory.dmp

Filesize
508KB

Download
memory/1552-197-0x0000000000160000-0x00000000001DF000-memory.dmp

Filesize
508KB

Download
memory/1592-203-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/1608-191-0x00000000001A0000-0x000000000021F000-memory.dmp

Filesize
508KB

Download
memory/1612-117-0x0000000000220000-0x000000000029F000-memory.dmp

Filesize
508KB

Download
memory/1648-82-0x0000000000190000-0x000000000020F000-memory.dmp

Filesize
508KB

Download
memory/1648-80-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1648-85-0x0000000000190000-0x000000000020F000-memory.dmp

Filesize
508KB

Download
memory/1648-84-0x0000000000190000-0x000000000020F000-memory.dmp

Filesize
508KB

Download
memory/1668-135-0x00000000000C0000-0x000000000013F000-memory.dmp

Filesize
508KB

Download
memory/1708-377-0x00000000000C0000-0x000000000013F000-memory.dmp

Filesize
508KB

Download
memory/1728-93-0x00000000000D0000-0x000000000014F000-memory.dmp

Filesize
508KB

Download
memory/1744-247-0x00000000000F0000-0x000000000016F000-memory.dmp

Filesize
508KB

Download
memory/1856-389-0x00000000000C0000-0x000000000013F000-memory.dmp

Filesize
508KB

Download
memory/1916-345-0x0000000000180000-0x00000000001FF000-memory.dmp

Filesize
508KB

Download
memory/1932-357-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/1936-351-0x0000000000150000-0x00000000001CF000-memory.dmp

Filesize
508KB

Download
memory/1952-221-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2052-235-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2064-147-0x00000000001E0000-0x000000000025F000-memory.dmp

Filesize
508KB

Download
memory/2104-179-0x00000000000F0000-0x000000000016F000-memory.dmp

Filesize
508KB

Download
memory/2140-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2140-78-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2144-365-0x0000000000100000-0x000000000017F000-memory.dmp

Filesize
508KB

Download
memory/2152-111-0x0000000000190000-0x000000000020F000-memory.dmp

Filesize
508KB

Download
memory/2164-253-0x00000000000F0000-0x000000000016F000-memory.dmp

Filesize
508KB

Download
memory/2216-383-0x0000000000130000-0x00000000001AF000-memory.dmp

Filesize
508KB

Download
memory/2260-99-0x0000000000170000-0x00000000001EF000-memory.dmp

Filesize
508KB

Download
memory/2292-215-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2360-105-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2384-297-0x00000000000D0000-0x000000000014F000-memory.dmp

Filesize
508KB

Download
memory/2408-289-0x00000000000C0000-0x000000000013F000-memory.dmp

Filesize
508KB

Download
memory/2424-315-0x0000000000110000-0x000000000018F000-memory.dmp

Filesize
508KB

Download
memory/2436-36-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2436-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2532-23-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2532-24-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2532-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2532-21-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2544-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2544-30-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2576-271-0x00000000000D0000-0x000000000014F000-memory.dmp

Filesize
508KB

Download
memory/2588-321-0x00000000000C0000-0x000000000013F000-memory.dmp

Filesize
508KB

Download
memory/2592-141-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2616-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-54-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2632-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2632-60-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2656-283-0x00000000000D0000-0x000000000014F000-memory.dmp

Filesize
508KB

Download
memory/2704-265-0x00000000001D0000-0x000000000024F000-memory.dmp

Filesize
508KB

Download
memory/2712-333-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2728-72-0x00000000000D0000-0x000000000014F000-memory.dmp

Filesize
508KB

Download
memory/2728-71-0x00000000000D0000-0x000000000014F000-memory.dmp

Filesize
508KB

Download
memory/2728-69-0x00000000000D0000-0x000000000014F000-memory.dmp

Filesize
508KB

Download
memory/2728-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-66-0x0000000000180000-0x00000000001FF000-memory.dmp

Filesize
508KB

Download
memory/2772-65-0x0000000000180000-0x00000000001FF000-memory.dmp

Filesize
508KB

Download
memory/2772-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-63-0x0000000000180000-0x00000000001FF000-memory.dmp

Filesize
508KB

Download
memory/2788-327-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2792-129-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2888-309-0x0000000000110000-0x000000000018F000-memory.dmp

Filesize
508KB

Download
memory/2904-48-0x00000000000F0000-0x000000000016F000-memory.dmp

Filesize
508KB

Download
memory/2904-47-0x00000000000F0000-0x000000000016F000-memory.dmp

Filesize
508KB

Download
memory/2904-45-0x00000000000F0000-0x000000000016F000-memory.dmp

Filesize
508KB

Download
memory/2904-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-42-0x0000000000080000-0x00000000000FF000-memory.dmp

Filesize
508KB

Download
memory/2984-79-0x00000000001D0000-0x000000000024F000-memory.dmp

Filesize
508KB

Download
memory/2984-18-0x00000000001D0000-0x000000000024F000-memory.dmp

Filesize
508KB

Download
memory/2984-17-0x00000000001D0000-0x000000000024F000-memory.dmp

Filesize
508KB

Download
memory/2984-16-0x00000000001D0000-0x000000000024F000-memory.dmp

Filesize
508KB

Download
memory/2984-14-0x00000000001D0000-0x000000000024F000-memory.dmp

Filesize
508KB

Download
memory/2984-13-0x00000000001D0000-0x000000000024F000-memory.dmp

Filesize
508KB

Download
memory/2984-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-11-0x00000000001D0000-0x000000000024F000-memory.dmp

Filesize
508KB

Download
memory/3004-173-0x0000000000130000-0x00000000001AF000-memory.dmp

Filesize
508KB

Download
memory/3008-277-0x0000000000110000-0x000000000018F000-memory.dmp

Filesize
508KB

Download
memory/3040-123-0x0000000000130000-0x00000000001AF000-memory.dmp

Filesize
508KB

Download