Malware Analysis Report

2025-01-02 03:07

Sample ID 240814-sjqmqsyfld
Target AntiRootInstaller.exe
SHA256 c6a386ba41efba3fa22d748ac1c5641dbcd450f5cf9a2334cfcb7a2c1cbc28b8
Tags
remcos remotehost discovery evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c6a386ba41efba3fa22d748ac1c5641dbcd450f5cf9a2334cfcb7a2c1cbc28b8

Threat Level: Known bad

The file AntiRootInstaller.exe was found to be: Known bad.

Malicious Activity Summary

remcos remotehost discovery evasion persistence rat trojan

Remcos

UAC bypass

Adds policy Run key to start application

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-14 15:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-14 15:09

Reported

2024-08-14 15:12

Platform

win7-20240708-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe"

Signatures

Remcos

rat remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\Remcos\$77-Installer C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
File opened for modification C:\Windows\SysWOW64\Remcos C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
File opened for modification C:\Windows\SysWOW64\Remcos \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
File opened for modification C:\Windows\SysWOW64\Remcos\$77-Installer \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
File created C:\Windows\SysWOW64\Remcos\$77-Installer C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2080 set thread context of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2972 set thread context of 2708 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Token: SeRestorePrivilege N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1000 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 1000 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 1000 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 1000 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 1000 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 1000 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 1000 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 1000 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Windows\system32\rundll32.exe
PID 1000 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Windows\system32\rundll32.exe
PID 1000 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Windows\system32\rundll32.exe
PID 2080 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 2452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1000 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Windows\system32\cmd.exe
PID 1000 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Windows\system32\cmd.exe
PID 1000 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 2424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2840 wrote to memory of 2424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2840 wrote to memory of 2424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2080 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2080 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2080 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2080 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2080 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2080 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2080 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2080 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 2972 wrote to memory of 2732 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2732 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2732 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2732 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2732 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2732 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2732 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2708 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2972 wrote to memory of 2708 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2972 wrote to memory of 2708 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2972 wrote to memory of 2708 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2972 wrote to memory of 2708 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2972 wrote to memory of 2708 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2972 wrote to memory of 2708 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2972 wrote to memory of 2708 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 2732 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2732 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2256 wrote to memory of 1664 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2256 wrote to memory of 1664 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2256 wrote to memory of 1664 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2256 wrote to memory of 1664 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe"

C:\Users\Admin\AppData\Local\Temp\Updater.exe

"C:\Users\Admin\AppData\Local\Temp\Updater.exe"

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Anti Root installer.py

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE2E0.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe"

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Anti Root installer.py"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cnafwkgcuyedxczobggirkydotm.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 mode-clusters.gl.at.ply.gg udp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp

Files

memory/1000-0-0x000007FEF6933000-0x000007FEF6934000-memory.dmp

memory/1000-1-0x0000000001360000-0x00000000013AC000-memory.dmp

memory/1000-4-0x000007FEF6930000-0x000007FEF731C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Updater.exe

MD5 db034c9466c83a31925b6fccd69c60ae
SHA1 f43959427039dae6e78494d0fbca2e0233fa4a07
SHA256 a817510b4e482dbb1235f616c2bd12e7f22be34f0d426846fd11db114be28be3
SHA512 d2d904527ff98f0b7caa9d75337b0823eafc091ef1a24ad4e41bb7caab6c2ddd65ef4a5150bdb1d23a4fef851649318a7ce9603082bf5828eb3707ad2340804b

C:\Users\Admin\AppData\Local\Temp\tmpE2E0.tmp.bat

MD5 b51cc1262ef8cc4ccc4607d717c54e76
SHA1 cdad9246db0c42dcccac42dcbd18708de740dbb8
SHA256 542e8ccefa6f411af8ec1389d9ed46a0a54742c61624f2e7a9b34230c7518ad0
SHA512 ded0f56badb4fe23ecf4f382f02682e9949816a47ee8d39dfceee4a9f5ec681e1b5bf03359a4ee7dfdb60979c25bfc4792aaaf21a90bc383515c309b55de15ba

memory/1000-24-0x000007FEF6930000-0x000007FEF731C000-memory.dmp

memory/2972-27-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-29-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-30-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-26-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2708-38-0x0000000000090000-0x0000000000112000-memory.dmp

memory/2972-39-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2708-36-0x0000000000090000-0x0000000000112000-memory.dmp

memory/2708-35-0x0000000000090000-0x0000000000112000-memory.dmp

memory/2708-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2972-41-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-40-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-42-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-44-0x00000000000D0000-0x0000000000152000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Anti Root installer.py

MD5 8d1d692457617cbead75c9a6164fc10b
SHA1 2a90a573c3035e12b18125918bcc86e22d3151b8
SHA256 7a1a73ecc20d4bfd885c8408e1aae70a1852c6c9f98b6e7ac2590a5b72588ab7
SHA512 eb2503bf9734e12fccbdcfe99b0a91b5d0bc25889f74bb8581fa3042cb72698ef4626524ad91a458607d7b34dad703076a2adc0428cfec57a664f6637b33f6fb

memory/2972-46-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-47-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-48-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-49-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-50-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-51-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-52-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-53-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-55-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-56-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-57-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-58-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-59-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-60-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-61-0x00000000000D0000-0x0000000000152000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 33db77aa562a0e503feb96a12a55d1ab
SHA1 cbbfb11b3585df1fd9ef05e6352700942820d20e
SHA256 196632ec40b0dfadc35c1ab84555f17f2c45ba2ee0313b867237b4aa0f19e572
SHA512 5c358698d9f5b939e13588f3bb7ea5f9a311a65ae7cc54c781194a8219f1ecfa140fb3aaf41ba002c3d0411d56962fbdf787ad6125f7704dd6f64e4fbbac2809

memory/2972-77-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-78-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-79-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-83-0x00000000000D0000-0x0000000000152000-memory.dmp

memory/2972-89-0x00000000000D0000-0x0000000000152000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cnafwkgcuyedxczobggirkydotm.vbs

MD5 54a769d74f2b983cb50faaf758561dbe
SHA1 c8f0dd48ebc00ca1fefcba1b904f04d93cab3228
SHA256 bebb01f3ebac7d6849f08374aa13883c6f657df0729f1ad03a100764688e8f4c
SHA512 2ed0cebda27b59db789fe98104529b43ffcf996926d9860e87c29ef7f73be64a160e24d4595642aa824fee86726f6f05451d1268096608b9ec0352fcde2b5692

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-14 15:09

Reported

2024-08-14 15:12

Platform

win10v2004-20240802-en

Max time kernel

94s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe"

Signatures

Remcos

rat remcos

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-G1AT0Q = "\"C:\\Windows\\SysWOW64\\Remcos\\$77-Installer\"" C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Remcos\$77-Installer C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
File opened for modification C:\Windows\SysWOW64\Remcos\$77-Installer C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
File opened for modification C:\Windows\SysWOW64\Remcos C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
File opened for modification C:\Windows\SysWOW64\Remcos \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
File opened for modification C:\Windows\SysWOW64\Remcos\$77-Installer \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1512 set thread context of 4980 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 4980 set thread context of 2140 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\program files (x86)\internet explorer\iexplore.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe N/A
N/A N/A \??\c:\program files (x86)\internet explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4396 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 4396 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 4396 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Users\Admin\AppData\Local\Temp\Updater.exe
PID 1512 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe C:\Windows\SysWOW64\cmd.exe
PID 4396 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Windows\system32\cmd.exe
PID 4396 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe C:\Windows\system32\cmd.exe
PID 608 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 608 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 608 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5036 wrote to memory of 3024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 5036 wrote to memory of 3024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1512 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1512 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1512 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 1512 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\Updater.exe \??\c:\program files (x86)\internet explorer\iexplore.exe
PID 4980 wrote to memory of 3460 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 4980 wrote to memory of 3460 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 4980 wrote to memory of 3460 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe
PID 4980 wrote to memory of 2140 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 4980 wrote to memory of 2140 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 4980 wrote to memory of 2140 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 4980 wrote to memory of 2140 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\svchost.exe
PID 3460 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3460 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3460 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4980 wrote to memory of 4588 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\WScript.exe
PID 4980 wrote to memory of 4588 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\WScript.exe
PID 4980 wrote to memory of 4588 N/A \??\c:\program files (x86)\internet explorer\iexplore.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\AntiRootInstaller.exe"

C:\Users\Admin\AppData\Local\Temp\Updater.exe

"C:\Users\Admin\AppData\Local\Temp\Updater.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7DEA.tmp.bat""

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\system32\timeout.exe

timeout 3

\??\c:\program files (x86)\internet explorer\iexplore.exe

"c:\program files (x86)\internet explorer\iexplore.exe"

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aikgcqynmcaz.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 mode-clusters.gl.at.ply.gg udp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 21.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 147.185.221.21:36304 mode-clusters.gl.at.ply.gg tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

memory/4396-0-0x00007FF8B9233000-0x00007FF8B9235000-memory.dmp

memory/4396-1-0x0000000000110000-0x000000000015C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Updater.exe

MD5 db034c9466c83a31925b6fccd69c60ae
SHA1 f43959427039dae6e78494d0fbca2e0233fa4a07
SHA256 a817510b4e482dbb1235f616c2bd12e7f22be34f0d426846fd11db114be28be3
SHA512 d2d904527ff98f0b7caa9d75337b0823eafc091ef1a24ad4e41bb7caab6c2ddd65ef4a5150bdb1d23a4fef851649318a7ce9603082bf5828eb3707ad2340804b

memory/4396-7-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

memory/4396-18-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7DEA.tmp.bat

MD5 ffa9e7865dc8a391dfc8cb75f67f9873
SHA1 6107ac3066bc91a96d03c5f39b7865943e89b47d
SHA256 6c0c94c942541c049f463ceb5098b51f5daf06d98d883a41db14fa285da04b0d
SHA512 9ae0dda0662ddd592b28054eeb35c56ca34dfc5b70ba7aec7e755f5954ab17abb70d8faa2543e3f3cf64f5fa0ca95d27fad07b6eadd6bb86f73c74118f8ff527

memory/4980-35-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-34-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/2140-39-0x0000000000F50000-0x0000000000FD2000-memory.dmp

memory/4980-33-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/2140-40-0x0000000000F50000-0x0000000000FD2000-memory.dmp

memory/4980-41-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-42-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-43-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-44-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-46-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-47-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-48-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-49-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-50-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-51-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-53-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-52-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-54-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-56-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-57-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-58-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-59-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-60-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-61-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-62-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-63-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-64-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-65-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-69-0x0000000000540000-0x00000000005C2000-memory.dmp

memory/4980-70-0x0000000000540000-0x00000000005C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\aikgcqynmcaz.vbs

MD5 54a769d74f2b983cb50faaf758561dbe
SHA1 c8f0dd48ebc00ca1fefcba1b904f04d93cab3228
SHA256 bebb01f3ebac7d6849f08374aa13883c6f657df0729f1ad03a100764688e8f4c
SHA512 2ed0cebda27b59db789fe98104529b43ffcf996926d9860e87c29ef7f73be64a160e24d4595642aa824fee86726f6f05451d1268096608b9ec0352fcde2b5692