remcos | a25bdcab7a38affd0798e5d674341724726c866e7cd7348b3d75bdb47ccca230

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2024, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5YXaP80M6975Ej.exe
Size 891KB
Sample240323-jdh62aef32
SHA256 a25bdcab7a38affd0798e5d674341724726c866e7cd7348b3d75bdb47ccca230
MD5 52f0f8c78caa712137ac2f2528738b75
SHA1 73cb280eb0ae2d807b9a7a928ab4634d7376a0ed
SHA512 25a37723954cb765dab04b03837e792990a63d6fe752f354b24c7b78e601cd4cab3e0e1c53ecec633e7bcc7d6a72e105036d12a6bd607d080a6e7d4e47385446
SSDEEP 24576:ewB6NgL6qamjlzHxdOGzX74iJ2RqYYjfogCPm3:V6OLPaMrxd374iJxa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos host collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

Host

37.120.235.114:2269

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FCA9SV
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 7 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3600-90-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/3600-94-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/2500-140-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/2500-144-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4508-158-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4508-164-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/3468-199-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2320-69-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/2320-105-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/2060-154-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/2060-174-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3604-208-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 19 IoCs

resource	yara_rule
behavioral2/memory/2320-69-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3600-90-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3600-94-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1376-93-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1376-95-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2320-105-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2500-140-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4088-143-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2500-144-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4088-145-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2060-154-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4508-158-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1612-165-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4508-164-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2060-174-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1612-172-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3468-199-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3604-208-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3668-209-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	c5YXaP80M6975Ej.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	c5YXaP80M6975Ej.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	c5YXaP80M6975Ej.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	c5YXaP80M6975Ej.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	c5YXaP80M6975Ej.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	c5YXaP80M6975Ej.exe

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 3596 set thread context of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 2572 set thread context of 2320	2572	c5YXaP80M6975Ej.exe	113
PID 2572 set thread context of 3600	2572	c5YXaP80M6975Ej.exe	116
PID 2572 set thread context of 1376	2572	c5YXaP80M6975Ej.exe	117
PID 2572 set thread context of 1376	2572	c5YXaP80M6975Ej.exe	119
PID 2572 set thread context of 2500	2572	c5YXaP80M6975Ej.exe	120
PID 2572 set thread context of 4088	2572	c5YXaP80M6975Ej.exe	122
PID 2572 set thread context of 2060	2572	c5YXaP80M6975Ej.exe	126
PID 2572 set thread context of 4508	2572	c5YXaP80M6975Ej.exe	129
PID 2572 set thread context of 1612	2572	c5YXaP80M6975Ej.exe	130
PID 2572 set thread context of 3604	2572	c5YXaP80M6975Ej.exe	131
PID 2572 set thread context of 3468	2572	c5YXaP80M6975Ej.exe	132
PID 2572 set thread context of 3668	2572	c5YXaP80M6975Ej.exe	135
PID 2572 set thread context of 2316	2572	c5YXaP80M6975Ej.exe	136
PID 2572 set thread context of 2352	2572	c5YXaP80M6975Ej.exe	137
PID 2572 set thread context of 1236	2572	c5YXaP80M6975Ej.exe	138

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3204	1376	WerFault.exe	119

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3596	c5YXaP80M6975Ej.exe
3596	c5YXaP80M6975Ej.exe
3596	c5YXaP80M6975Ej.exe
3596	c5YXaP80M6975Ej.exe
1864	powershell.exe
1864	powershell.exe
1864	powershell.exe
2320	c5YXaP80M6975Ej.exe
2320	c5YXaP80M6975Ej.exe
1376	c5YXaP80M6975Ej.exe
1376	c5YXaP80M6975Ej.exe
2320	c5YXaP80M6975Ej.exe
2320	c5YXaP80M6975Ej.exe
4088	c5YXaP80M6975Ej.exe
4088	c5YXaP80M6975Ej.exe
2060	c5YXaP80M6975Ej.exe
2060	c5YXaP80M6975Ej.exe
2060	c5YXaP80M6975Ej.exe
2060	c5YXaP80M6975Ej.exe
1612	c5YXaP80M6975Ej.exe
1612	c5YXaP80M6975Ej.exe
3604	c5YXaP80M6975Ej.exe
3604	c5YXaP80M6975Ej.exe
3604	c5YXaP80M6975Ej.exe
3604	c5YXaP80M6975Ej.exe
3668	c5YXaP80M6975Ej.exe
3668	c5YXaP80M6975Ej.exe
2316	c5YXaP80M6975Ej.exe
2316	c5YXaP80M6975Ej.exe
2316	c5YXaP80M6975Ej.exe
2316	c5YXaP80M6975Ej.exe
1236	c5YXaP80M6975Ej.exe
1236	c5YXaP80M6975Ej.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe
2572	c5YXaP80M6975Ej.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	c5YXaP80M6975Ej.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1376	c5YXaP80M6975Ej.exe
Token: SeDebugPrivilege	4088	c5YXaP80M6975Ej.exe
Token: SeDebugPrivilege	1612	c5YXaP80M6975Ej.exe
Token: SeDebugPrivilege	3668	c5YXaP80M6975Ej.exe
Token: SeDebugPrivilege	1236	c5YXaP80M6975Ej.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	c5YXaP80M6975Ej.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1376	c5YXaP80M6975Ej.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 1864	3596	c5YXaP80M6975Ej.exe	107
PID 3596 wrote to memory of 1864	3596	c5YXaP80M6975Ej.exe	107
PID 3596 wrote to memory of 1864	3596	c5YXaP80M6975Ej.exe	107
PID 3596 wrote to memory of 4916	3596	c5YXaP80M6975Ej.exe	109
PID 3596 wrote to memory of 4916	3596	c5YXaP80M6975Ej.exe	109
PID 3596 wrote to memory of 4916	3596	c5YXaP80M6975Ej.exe	109
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 3596 wrote to memory of 2572	3596	c5YXaP80M6975Ej.exe	111
PID 2572 wrote to memory of 2320	2572	c5YXaP80M6975Ej.exe	113
PID 2572 wrote to memory of 2320	2572	c5YXaP80M6975Ej.exe	113
PID 2572 wrote to memory of 2320	2572	c5YXaP80M6975Ej.exe	113
PID 2572 wrote to memory of 2320	2572	c5YXaP80M6975Ej.exe	113
PID 2572 wrote to memory of 4604	2572	c5YXaP80M6975Ej.exe	114
PID 2572 wrote to memory of 4604	2572	c5YXaP80M6975Ej.exe	114
PID 2572 wrote to memory of 4604	2572	c5YXaP80M6975Ej.exe	114
PID 2572 wrote to memory of 3956	2572	c5YXaP80M6975Ej.exe	115
PID 2572 wrote to memory of 3956	2572	c5YXaP80M6975Ej.exe	115
PID 2572 wrote to memory of 3956	2572	c5YXaP80M6975Ej.exe	115
PID 2572 wrote to memory of 3600	2572	c5YXaP80M6975Ej.exe	116
PID 2572 wrote to memory of 3600	2572	c5YXaP80M6975Ej.exe	116
PID 2572 wrote to memory of 3600	2572	c5YXaP80M6975Ej.exe	116
PID 2572 wrote to memory of 3600	2572	c5YXaP80M6975Ej.exe	116
PID 2572 wrote to memory of 1376	2572	c5YXaP80M6975Ej.exe	117
PID 2572 wrote to memory of 1376	2572	c5YXaP80M6975Ej.exe	117
PID 2572 wrote to memory of 1376	2572	c5YXaP80M6975Ej.exe	117
PID 2572 wrote to memory of 1376	2572	c5YXaP80M6975Ej.exe	117
PID 2572 wrote to memory of 1376	2572	c5YXaP80M6975Ej.exe	119
PID 2572 wrote to memory of 1376	2572	c5YXaP80M6975Ej.exe	119
PID 2572 wrote to memory of 1376	2572	c5YXaP80M6975Ej.exe	119
PID 2572 wrote to memory of 1376	2572	c5YXaP80M6975Ej.exe	119
PID 2572 wrote to memory of 2500	2572	c5YXaP80M6975Ej.exe	120
PID 2572 wrote to memory of 2500	2572	c5YXaP80M6975Ej.exe	120
PID 2572 wrote to memory of 2500	2572	c5YXaP80M6975Ej.exe	120
PID 2572 wrote to memory of 2500	2572	c5YXaP80M6975Ej.exe	120
PID 2572 wrote to memory of 3148	2572	c5YXaP80M6975Ej.exe	121
PID 2572 wrote to memory of 3148	2572	c5YXaP80M6975Ej.exe	121
PID 2572 wrote to memory of 3148	2572	c5YXaP80M6975Ej.exe	121
PID 2572 wrote to memory of 4088	2572	c5YXaP80M6975Ej.exe	122
PID 2572 wrote to memory of 4088	2572	c5YXaP80M6975Ej.exe	122
PID 2572 wrote to memory of 4088	2572	c5YXaP80M6975Ej.exe	122
PID 2572 wrote to memory of 4088	2572	c5YXaP80M6975Ej.exe	122
PID 2572 wrote to memory of 2060	2572	c5YXaP80M6975Ej.exe	126
PID 2572 wrote to memory of 2060	2572	c5YXaP80M6975Ej.exe	126
PID 2572 wrote to memory of 2060	2572	c5YXaP80M6975Ej.exe	126
PID 2572 wrote to memory of 2060	2572	c5YXaP80M6975Ej.exe	126
PID 2572 wrote to memory of 4496	2572	c5YXaP80M6975Ej.exe	127
PID 2572 wrote to memory of 4496	2572	c5YXaP80M6975Ej.exe	127
PID 2572 wrote to memory of 4496	2572	c5YXaP80M6975Ej.exe	127
PID 2572 wrote to memory of 3000	2572	c5YXaP80M6975Ej.exe	128
PID 2572 wrote to memory of 3000	2572	c5YXaP80M6975Ej.exe	128
PID 2572 wrote to memory of 3000	2572	c5YXaP80M6975Ej.exe	128
PID 2572 wrote to memory of 4508	2572	c5YXaP80M6975Ej.exe	129
PID 2572 wrote to memory of 4508	2572	c5YXaP80M6975Ej.exe	129
PID 2572 wrote to memory of 4508	2572	c5YXaP80M6975Ej.exe	129

C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
"C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sirYRCGgC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sirYRCGgC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp431.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4916
- C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
  "C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\qoopqqhwbppgfyptapkuojd"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\bitiqisqpxhtqmdxszwvzoqtec"
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\bitiqisqpxhtqmdxszwvzoqtec"
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\bitiqisqpxhtqmdxszwvzoqtec"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\lkhbrbcjdfzystzbbkjpcblbnjuav"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\xxofmbpdcxjhnvgh"
    3⤵
    - Suspicious use of UnmapMainImage
    PID:1376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 12
      4⤵
      Program crash
      PID:3204
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\azuynuaxqfcmpbulwrsz"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\ktziomlyenuzahqxocfauzz"
    3⤵
    PID:3148
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\ktziomlyenuzahqxocfauzz"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\eiviktfkrky"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\pcaslmqensqxowj"
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\pcaslmqensqxowj"
    3⤵
    PID:3000
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\pcaslmqensqxowj"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\regllwafbaicydxlic"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\dznqg"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\otbihxgt"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\yvgbiqrmchd"
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\yvgbiqrmchd"
    3⤵
    PID:2308
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\yvgbiqrmchd"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3668
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\avfyhkcobkbyj"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\dxkradnqpstctnch"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe
    C:\Users\Admin\AppData\Local\Temp\c5YXaP80M6975Ej.exe /stext "C:\Users\Admin\AppData\Local\Temp\nrqkbvxjdalpwtylptpe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1376 -ip 1376
1⤵
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 f3bbb96369962b90e4700a61f54b72f9601693e8ae28474284278bfee03f64a3
MD5 4b7aa9170ffb96149a9ecbc006913699
SHA1 2e40b555dc7add4fff887ae4d05d2644dc856abd
SHA512 9f6c927260b1eebb0c3499f6c4c7bc32ac2bd9cc80545cdccb9921d04bd450e8f75e3644e1431f8ca9e08e394378d9e457cc03c5abfed24abc65a7191f0938e7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_z1ahmbo1.cyl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z1ahmbo1.cyl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

bhvC251.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhvC251.tmp
Size 6.5MB
SHA256 394b5c22629674fd4e5bd278a25b36f0ae660dee62c974f7b04dc7308f85c9b7
MD5 73fddc9e820957bc7ea35b60a99d6936
SHA1 d9d6de5026e654bc30c727a278bd72dce34a14b5
SHA512 7106c44174b26a508634dc5f7f57c19167719978d44b891e23b97c48b153c8cba8b0e300fecfc7f5a4f077cd84d2bbd90e348b22823d95a3e4ea01e88165acb1
SSDEEP 6144:4oz9eVVP8B57CfrCCSPhjPEJJN1nRdNRdjb+35gcnT7:4Y0V+7C7dzd
MD5 SHA1 SHA512 SSDEEP

Submit Download

chp9ECC.tmp

Path C:\Users\Admin\AppData\Local\Temp\chp9ECC.tmp
Size 220KB
SHA256 ebd34ebd586d89a768cd16c5c773ab32bd260462047f200b995e3956a1bf0a2f
MD5 d04123ed98dc315274ad724f71eb3c6a
SHA1 303f2209f4463fbcfd54cd530cf64c54dc359e4f
SHA512 a46ed9e1b1306a671903b8d084cb047aa5c06bbc686e4c949e26963b02c7292b019642b8a901dcf42c263886117f1024052ddfd00929f564a2d96a415da0a81e
SSDEEP 384:a3KhfjQQnlnoqtLK+CrDp9IpIq6kgcP7EeKjVumby:bjzndoqtLK+CrjIpIq6TcP7EeKry
MD5 SHA1 SHA512 SSDEEP

Submit Download

chp9EDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\chp9EDD.tmp
Size 56KB
SHA256 8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259
MD5 d444c807029c83b8a892ac0c4971f955
SHA1 fa58ce7588513519dc8fed939b26b05dc25e53b5
SHA512 b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e
SSDEEP 96:27/KLPeymOT7ynlm+yKwt7izhGnvFbn8MouB6w9f/nP:274CnlmVizhGR7Iw9fP
MD5 SHA1 SHA512 SSDEEP

Submit Download

qoopqqhwbppgfyptapkuojd

Path C:\Users\Admin\AppData\Local\Temp\qoopqqhwbppgfyptapkuojd
Size 4KB
SHA256 7176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04
MD5 10fa8ec140c204486092fb161e567ec7
SHA1 4d63e1f8df3afefedb19df73d7ee5f3b1e7b6473
SHA512 9db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76
SSDEEP 48:wvvv05xfvvc5xfdvv05xBvv05xakvv057:mvAxvYp1vAPvAbvA7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp431.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp431.tmp
Size 1KB
SHA256 1bb7c06faff1ec7c8c6ddfc1ac79f5f0f96c8fddb4b9aa72d2e2a454f377883f
MD5 dd4b14bad275e9e7568e3f4ebebc53b7
SHA1 953f922207c16edb0cfeb0fb97e2d81ad7ccaa36
SHA512 e7f2947fc0fac5d88b7946243d9a17e9b906d6f2e176f813ace44b7840a2f3c64e450a2ce8b9131f04bda488d5983476080820697c811cb7cb5097b94aaef6fd
MD5 SHA1 SHA512

Submit Download

memory/1376-84-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1376-91-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1376-93-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1376-95-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1612-159-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1612-165-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1612-172-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1864-32-0x0000000005210000-0x0000000005232000-memory.dmp

Download

memory/1864-115-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/1864-66-0x00000000067B0000-0x00000000067E2000-memory.dmp

Download

memory/1864-20-0x00000000053B0000-0x00000000059D8000-memory.dmp

Download

memory/1864-67-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Download

memory/1864-64-0x000000007F180000-0x000000007F190000-memory.dmp

Download

memory/1864-128-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/1864-124-0x00000000078B0000-0x00000000078B8000-memory.dmp

Download

memory/1864-122-0x00000000078C0000-0x00000000078DA000-memory.dmp

Download

memory/1864-121-0x0000000007870000-0x0000000007884000-memory.dmp

Download

memory/1864-120-0x0000000007780000-0x000000000778E000-memory.dmp

Download

memory/1864-118-0x0000000007710000-0x0000000007721000-memory.dmp

Download

memory/1864-80-0x0000000006790000-0x00000000067AE000-memory.dmp

Download

memory/1864-117-0x0000000007790000-0x0000000007826000-memory.dmp

Download

memory/1864-18-0x0000000004D70000-0x0000000004D80000-memory.dmp

Download

memory/1864-39-0x00000000052B0000-0x0000000005316000-memory.dmp

Download

memory/1864-40-0x0000000005C10000-0x0000000005C76000-memory.dmp

Download

memory/1864-45-0x0000000005DE0000-0x0000000006134000-memory.dmp

Download

memory/1864-113-0x0000000007580000-0x000000000758A000-memory.dmp

Download

memory/1864-19-0x0000000004D70000-0x0000000004D80000-memory.dmp

Download

memory/1864-48-0x0000000006240000-0x000000000625E000-memory.dmp

Download

memory/1864-16-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/1864-49-0x00000000065C0000-0x000000000660C000-memory.dmp

Download

memory/1864-83-0x0000000007430000-0x00000000074D3000-memory.dmp

Download

memory/1864-97-0x0000000007510000-0x000000000752A000-memory.dmp

Download

memory/1864-96-0x0000000007B60000-0x00000000081DA000-memory.dmp

Download

memory/1864-15-0x0000000004C20000-0x0000000004C56000-memory.dmp

Download

memory/1864-57-0x0000000004D70000-0x0000000004D80000-memory.dmp

Download

memory/2060-149-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2060-154-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2060-174-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2320-105-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2320-62-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2320-65-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2320-69-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2500-137-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2500-140-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2500-144-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2572-125-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-129-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-61-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-176-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-60-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-23-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-58-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-22-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-56-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-55-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-53-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-52-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-51-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-107-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2572-50-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-111-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2572-112-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2572-114-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-47-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-46-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-116-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2572-33-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-30-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-31-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-26-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-27-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-123-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-132-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-130-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2572-24-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3468-199-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3596-9-0x00000000073F0000-0x00000000074B0000-memory.dmp

Download

memory/3596-7-0x0000000006E00000-0x0000000006E08000-memory.dmp

Download

memory/3596-4-0x0000000005B20000-0x0000000005B30000-memory.dmp

Download

memory/3596-5-0x0000000005910000-0x000000000591A000-memory.dmp

Download

memory/3596-1-0x0000000000E20000-0x0000000000F04000-memory.dmp

Download

memory/3596-6-0x0000000006DE0000-0x0000000006DF6000-memory.dmp

Download

memory/3596-21-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/3596-2-0x0000000005E50000-0x00000000063F4000-memory.dmp

Download

memory/3596-0-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/3596-28-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/3596-8-0x0000000006F30000-0x0000000006F3C000-memory.dmp

Download

memory/3596-3-0x0000000005940000-0x00000000059D2000-memory.dmp

Download

memory/3596-10-0x0000000009A20000-0x0000000009ABC000-memory.dmp

Download

memory/3600-79-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3600-90-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3600-82-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3600-94-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3604-208-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3604-189-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3668-209-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4088-143-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4088-145-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4088-141-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4508-164-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4508-155-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4508-158-0x0000000000400000-0x0000000000462000-memory.dmp

Download