remcos | 8f02ecb26530c0a13b7f00020ebca144fc271fe36a5caaba1f4b3270e8e0023c

General

Target

SecuriteInfo.com.Win32.PWSX-gen.22684.exe
Size

892KB
MD5

636a54861ddd167065f294cc76fca7ba
SHA1

7e3eba28bc4b89801c91de5450aa28da5c6ff941
SHA256

8f02ecb26530c0a13b7f00020ebca144fc271fe36a5caaba1f4b3270e8e0023c
SHA512

cde7be19fc7fa841d22521a6c5ad01129ff604b2f91c1c16e0da7d91434cd962af25a39c8ab43c14915536b47d652eb2e55cf0fab5178a9553ab0f8f74833fc4
SSDEEP

24576:GgkHhAVqHxUrlWy05hMud6hHERSIhO0RDP+dB8:I2V+Ur6MIMHERSIQ0RDr

Score

10^/10

remcos remotehost collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

paygateme.net:2286

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WTDTSU
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/2624-70-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/2624-84-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/2836-64-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/2836-81-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2836-64-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/2624-70-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/788-74-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/788-75-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/788-76-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/2836-81-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/2624-84-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

SecuriteInfo.com.Win32.PWSX-gen.22684.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	SecuriteInfo.com.Win32.PWSX-gen.22684.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.22684.exeSecuriteInfo.com.Win32.PWSX-gen.22684.exe

description	pid	process	target process
PID 2480 set thread context of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 set thread context of 2836	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 set thread context of 2624	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 set thread context of 788	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2504 schtasks.exe

pid	process
2504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.22684.exepowershell.exeSecuriteInfo.com.Win32.PWSX-gen.22684.exe

pid	process
2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2648	powershell.exe
2836	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2836	SecuriteInfo.com.Win32.PWSX-gen.22684.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.22684.exe

pid	process
2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.22684.exepowershell.exeSecuriteInfo.com.Win32.PWSX-gen.22684.exe

description	pid	process
Token: SeDebugPrivilege	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	788	SecuriteInfo.com.Win32.PWSX-gen.22684.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.22684.exe

pid process

2512 SecuriteInfo.com.Win32.PWSX-gen.22684.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.22684.exeSecuriteInfo.com.Win32.PWSX-gen.22684.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tzRVJJzEigd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tzRVJJzEigd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp405A.tmp"
2⤵
- Creates scheduled task(s)
PID:2504

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe"
2⤵
PID:2180

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe"
2⤵
PID:2680

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe /stext "C:\Users\Admin\AppData\Local\Temp\pnuacjnzacyosynethhdgv"
3⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe /stext "C:\Users\Admin\AppData\Local\Temp\pnuacjnzacyosynethhdgv"
3⤵
PID:1912

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe /stext "C:\Users\Admin\AppData\Local\Temp\pnuacjnzacyosynethhdgv"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2836

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe /stext "C:\Users\Admin\AppData\Local\Temp\zhzldtytwkqtdmjiksuxricdr"
3⤵
- Accesses Microsoft Outlook accounts
PID:2624

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe /stext "C:\Users\Admin\AppData\Local\Temp\jbfddmiuktiyfsxmtdhyumwuaiqz"
3⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22684.exe /stext "C:\Users\Admin\AppData\Local\Temp\jbfddmiuktiyfsxmtdhyumwuaiqz"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
bcd9f0bfac3a73334fdc2c98dab2c631

SHA1
6235d0b03a20f8e97582698a9873bef70ba146c0

SHA256
0aedf622b657b180f7a81210e393562ff92133e341f27f78ae97fd48f623564e

SHA512
ee8e1c097e1c453ebe864915374ffac8972431f6030ec9a8bb77ca109e2bd1bd2314a9da3eefaf768d7956482fc4015f65a51df21c708c44a6c8ae12a8505ba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pnuacjnzacyosynethhdgv
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp405A.tmp
Filesize
1KB

MD5
79a4a5a45db38f8e96e531d444c9070c

SHA1
78cf2a96ebd585946c8eaa5b7d5b9d36fa1fdf1e

SHA256
c994a716c0a32494b68296b70d6d0470c1a18b172e8e278cda0c2016371d964d

SHA512
603e1999333319f2709b1a8858dc2d19bb2693b812d34be3440ae6f86a64b4d318e2b34a8712ff5f50e76205c8b9bea05830eaae7452fbff0351c2d019f288c4

Download Submit
memory/788-73-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/788-76-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/788-75-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/788-74-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/788-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/788-71-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2480-4-0x0000000001E00000-0x0000000001E0C000-memory.dmp

Filesize
48KB

Download
memory/2480-5-0x00000000053D0000-0x0000000005490000-memory.dmp

Filesize
768KB

Download
memory/2480-3-0x0000000001DE0000-0x0000000001DF0000-memory.dmp

Filesize
64KB

Download
memory/2480-2-0x00000000048A0000-0x00000000048E0000-memory.dmp

Filesize
256KB

Download
memory/2480-1-0x0000000074990000-0x000000007507E000-memory.dmp

Filesize
6.9MB

Download
memory/2480-34-0x0000000074990000-0x000000007507E000-memory.dmp

Filesize
6.9MB

Download
memory/2480-0-0x00000000000E0000-0x00000000001C6000-memory.dmp

Filesize
920KB

Download
memory/2512-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2512-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-121-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-120-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-113-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-112-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-100-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2512-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-88-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2512-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-95-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-94-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-92-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-91-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2512-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-90-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-89-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2512-85-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2624-70-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2624-65-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2624-84-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2624-68-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2648-46-0x0000000001EB0000-0x0000000001EF0000-memory.dmp

Filesize
256KB

Download
memory/2648-48-0x000000006ED60000-0x000000006F30B000-memory.dmp

Filesize
5.7MB

Download
memory/2648-47-0x0000000001EB0000-0x0000000001EF0000-memory.dmp

Filesize
256KB

Download
memory/2648-44-0x0000000001EB0000-0x0000000001EF0000-memory.dmp

Filesize
256KB

Download
memory/2648-42-0x000000006ED60000-0x000000006F30B000-memory.dmp

Filesize
5.7MB

Download
memory/2648-40-0x000000006ED60000-0x000000006F30B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-64-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2836-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2836-58-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2836-81-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

description	pid	process	target process
PID 2480 wrote to memory of 2648	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	powershell.exe
PID 2480 wrote to memory of 2648	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	powershell.exe
PID 2480 wrote to memory of 2648	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	powershell.exe
PID 2480 wrote to memory of 2648	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	powershell.exe
PID 2480 wrote to memory of 2504	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	schtasks.exe
PID 2480 wrote to memory of 2504	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	schtasks.exe
PID 2480 wrote to memory of 2504	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	schtasks.exe
PID 2480 wrote to memory of 2504	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	schtasks.exe
PID 2480 wrote to memory of 2180	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2180	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2180	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2180	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2680	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2680	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2680	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2680	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2480 wrote to memory of 2512	2480	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1236	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1236	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1236	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1236	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1912	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1912	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1912	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1912	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2836	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2836	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2836	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2836	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2836	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2624	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2624	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2624	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2624	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 2624	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1676	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1676	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1676	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 1676	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 788	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 788	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 788	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 788	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe
PID 2512 wrote to memory of 788	2512	SecuriteInfo.com.Win32.PWSX-gen.22684.exe	SecuriteInfo.com.Win32.PWSX-gen.22684.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads