remcos | 096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf.exe
Size 1.5MB
Sample240719-q5asasthml
SHA256 096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf
MD5 1b3bdc21a8aa04688c5a8a7001390b5d
SHA1 579a74f0bee2f65accff5810dffde1239da701db
SHA512 e5cb18a991672a9b5d910dcdc54e7c4e9e31ccceef293fccb043d606335c743c944783a2cf2b2ab7b1fd28fc5a8906a7ad9b0f1eeff537ad07a24a3b58f28339
SSDEEP 24576:a6nVMk+HIj90c6kkdWTyTqLA45DopywfIPQZ3YKb7hlV9CTs0bydWy2UE43YP0bo:ZVz7t11TAoAmDqR5Y27VwlPW2Luku6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos riches collection evasion execution persistence rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RICHES

75.127.7.188:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Intel22.exe
copy_folder
Intel22
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
intel22
keylog_path
%AppData%
mouse_option
false
mutex
Rmc-D3CYN5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1776-381-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4092-375-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/436-374-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4092-375-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/436-374-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3488	powershell.exe
996	powershell.exe
4792	powershell.exe
4024	powershell.exe
800	powershell.exe
1592	powershell.exe
4584	powershell.exe
4244	powershell.exe
1960	powershell.exe
4784	powershell.exe
4804	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	eoccfrsi.msc

Executes dropped EXE 7 IoCs

pid	Process
2372	eoccfrsi.msc
2392	RegSvcs.exe
436	RegSvcs.exe
4092	RegSvcs.exe
2376	RegSvcs.exe
3272	RegSvcs.exe
1776	RegSvcs.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Desktop Outlook = "C:\\Users\\Admin\\AppData\\Roaming\\awgo\\EOCCFR~1.EXE C:\\Users\\Admin\\AppData\\Roaming\\awgo\\lkjaaj.msc"	eoccfrsi.msc

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2392	2372	eoccfrsi.msc	123
PID 2392 set thread context of 436	2392	RegSvcs.exe	125
PID 2392 set thread context of 4092	2392	RegSvcs.exe	127
PID 2392 set thread context of 1776	2392	RegSvcs.exe	129

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3120	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
4244	powershell.exe
4244	powershell.exe
1592	powershell.exe
1592	powershell.exe
4584	powershell.exe
4584	powershell.exe
1960	powershell.exe
1960	powershell.exe
3488	powershell.exe
3488	powershell.exe
4784	powershell.exe
4784	powershell.exe
1592	powershell.exe
4244	powershell.exe
1960	powershell.exe
4584	powershell.exe
3488	powershell.exe
4784	powershell.exe
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc
2372	eoccfrsi.msc

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2392	RegSvcs.exe
2392	RegSvcs.exe
2392	RegSvcs.exe
2392	RegSvcs.exe
2392	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeDebugPrivilege	996	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	1776	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2392	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1412	3648	096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf.exe	89
PID 3648 wrote to memory of 1412	3648	096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf.exe	89
PID 3648 wrote to memory of 1412	3648	096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf.exe	89
PID 1412 wrote to memory of 2628	1412	WScript.exe	96
PID 1412 wrote to memory of 2628	1412	WScript.exe	96
PID 1412 wrote to memory of 2628	1412	WScript.exe	96
PID 1412 wrote to memory of 3508	1412	WScript.exe	98
PID 1412 wrote to memory of 3508	1412	WScript.exe	98
PID 1412 wrote to memory of 3508	1412	WScript.exe	98
PID 2628 wrote to memory of 3120	2628	cmd.exe	100
PID 2628 wrote to memory of 3120	2628	cmd.exe	100
PID 2628 wrote to memory of 3120	2628	cmd.exe	100
PID 3508 wrote to memory of 2372	3508	cmd.exe	101
PID 3508 wrote to memory of 2372	3508	cmd.exe	101
PID 3508 wrote to memory of 2372	3508	cmd.exe	101
PID 2372 wrote to memory of 1592	2372	eoccfrsi.msc	102
PID 2372 wrote to memory of 1592	2372	eoccfrsi.msc	102
PID 2372 wrote to memory of 1592	2372	eoccfrsi.msc	102
PID 2372 wrote to memory of 4584	2372	eoccfrsi.msc	104
PID 2372 wrote to memory of 4584	2372	eoccfrsi.msc	104
PID 2372 wrote to memory of 4584	2372	eoccfrsi.msc	104
PID 2372 wrote to memory of 4244	2372	eoccfrsi.msc	106
PID 2372 wrote to memory of 4244	2372	eoccfrsi.msc	106
PID 2372 wrote to memory of 4244	2372	eoccfrsi.msc	106
PID 2372 wrote to memory of 1960	2372	eoccfrsi.msc	108
PID 2372 wrote to memory of 1960	2372	eoccfrsi.msc	108
PID 2372 wrote to memory of 1960	2372	eoccfrsi.msc	108
PID 2372 wrote to memory of 3488	2372	eoccfrsi.msc	110
PID 2372 wrote to memory of 3488	2372	eoccfrsi.msc	110
PID 2372 wrote to memory of 3488	2372	eoccfrsi.msc	110
PID 2372 wrote to memory of 4784	2372	eoccfrsi.msc	112
PID 2372 wrote to memory of 4784	2372	eoccfrsi.msc	112
PID 2372 wrote to memory of 4784	2372	eoccfrsi.msc	112
PID 2372 wrote to memory of 4440	2372	eoccfrsi.msc	114
PID 2372 wrote to memory of 4440	2372	eoccfrsi.msc	114
PID 2372 wrote to memory of 4440	2372	eoccfrsi.msc	114
PID 1412 wrote to memory of 896	1412	WScript.exe	116
PID 1412 wrote to memory of 896	1412	WScript.exe	116
PID 1412 wrote to memory of 896	1412	WScript.exe	116
PID 3488 wrote to memory of 996	3488	powershell.exe	118
PID 3488 wrote to memory of 996	3488	powershell.exe	118
PID 3488 wrote to memory of 996	3488	powershell.exe	118
PID 1960 wrote to memory of 4804	1960	powershell.exe	119
PID 1960 wrote to memory of 4804	1960	powershell.exe	119
PID 1960 wrote to memory of 4804	1960	powershell.exe	119
PID 4244 wrote to memory of 4792	4244	powershell.exe	120
PID 4244 wrote to memory of 4792	4244	powershell.exe	120
PID 4244 wrote to memory of 4792	4244	powershell.exe	120
PID 4584 wrote to memory of 4024	4584	powershell.exe	121
PID 4584 wrote to memory of 4024	4584	powershell.exe	121
PID 4584 wrote to memory of 4024	4584	powershell.exe	121
PID 4784 wrote to memory of 800	4784	powershell.exe	122
PID 4784 wrote to memory of 800	4784	powershell.exe	122
PID 4784 wrote to memory of 800	4784	powershell.exe	122
PID 2372 wrote to memory of 2392	2372	eoccfrsi.msc	123
PID 2372 wrote to memory of 2392	2372	eoccfrsi.msc	123
PID 2372 wrote to memory of 2392	2372	eoccfrsi.msc	123
PID 2372 wrote to memory of 2392	2372	eoccfrsi.msc	123
PID 2372 wrote to memory of 2392	2372	eoccfrsi.msc	123
PID 2392 wrote to memory of 436	2392	RegSvcs.exe	125
PID 2392 wrote to memory of 436	2392	RegSvcs.exe	125
PID 2392 wrote to memory of 436	2392	RegSvcs.exe	125
PID 2392 wrote to memory of 436	2392	RegSvcs.exe	125
PID 2392 wrote to memory of 3272	2392	RegSvcs.exe	126

C:\Users\Admin\AppData\Local\Temp\096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf.exe
"C:\Users\Admin\AppData\Local\Temp\096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\juix.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:3120
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c eoccfrsi.msc lkjaaj.msc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\eoccfrsi.msc
      eoccfrsi.msc lkjaaj.msc
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\RarSFX0
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4584
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess RegSvcs.exe
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionExtension '.vbs'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4244
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionExtension .vbs
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4792
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionExtension '.vbe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionExtension .vbe
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4804
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionExtension '*.vbs'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3488
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionExtension *.vbs
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:996
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionExtension '*.vbe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4784
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionExtension *.vbe
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 30 /tn WindowsRepaire /tr "C:\Users\Admin\AppData\Roaming\awgo\EOCCFR~1.EXE C:\Users\Admin\AppData\Roaming\awgo\lkjaaj.msc"
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\rnoqhkxdmscuzbooexqcwsmecpep"
        6⤵
        Executes dropped EXE
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\chtbadifiauhbqcsvidvhfhuldvybjqd"
        6⤵
        Executes dropped EXE
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\chtbadifiauhbqcsvidvhfhuldvybjqd"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\ejzt"
        6⤵
        Executes dropped EXE
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\ejzt"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...