remcos | dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
Size

1.3MB
MD5

e3504f07ea46e8c5ce1321b44e752556
SHA1

e5c612e6de7696296a13a5c59ee1712084559919
SHA256

dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e
SHA512

5aeb6baa9d02cdcfed6a02301bce02460b4b68c06ef3e9038bb4b1ba01ce3ad4884a5271653352527c625801519cfcfffdd9c1d03e005dbe3c21d3b460c4db5d
SSDEEP

24576:qAHnh+eWsN3skA4RV1Hom2KXMmHaYMCcRJjERtK/cfrWIlcf6NyEi5:9h+ZkldoPK8YaYrc/jYK/cf6YcCM

Score

10^/10

remcos dorobumajor discovery evasion rat trojan

Malware Config

Extracted

Family

remcos

Botnet

dorobumajor

84.38.132.40:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
testhostex.exe
copy_folder
dorbion
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WBALP5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 2716	2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	30
PID 2716 set thread context of 2984	2716	svchost.exe	33
PID 2716 set thread context of 2912	2716	svchost.exe	35
PID 2716 set thread context of 2744	2716	svchost.exe	36
PID 2716 set thread context of 2600	2716	svchost.exe	37
PID 2716 set thread context of 2676	2716	svchost.exe	38
PID 2716 set thread context of 3056	2716	svchost.exe	39
PID 2716 set thread context of 2672	2716	svchost.exe	40
PID 2716 set thread context of 2568	2716	svchost.exe	41
PID 2716 set thread context of 1996	2716	svchost.exe	42
PID 2716 set thread context of 1432	2716	svchost.exe	43
PID 2716 set thread context of 2988	2716	svchost.exe	44
PID 2716 set thread context of 2252	2716	svchost.exe	45
PID 2716 set thread context of 2928	2716	svchost.exe	46
PID 2716 set thread context of 2644	2716	svchost.exe	47
PID 2716 set thread context of 1784	2716	svchost.exe	48
PID 2716 set thread context of 1708	2716	svchost.exe	49
PID 2716 set thread context of 940	2716	svchost.exe	50
PID 2716 set thread context of 2408	2716	svchost.exe	51
PID 2716 set thread context of 2080	2716	svchost.exe	52
PID 2716 set thread context of 648	2716	svchost.exe	53
PID 2716 set thread context of 1092	2716	svchost.exe	54
PID 2716 set thread context of 2308	2716	svchost.exe	55
PID 2716 set thread context of 2480	2716	svchost.exe	56
PID 2716 set thread context of 2144	2716	svchost.exe	57
PID 2716 set thread context of 2076	2716	svchost.exe	58
PID 2716 set thread context of 2384	2716	svchost.exe	59
PID 2716 set thread context of 2192	2716	svchost.exe	60
PID 2716 set thread context of 2492	2716	svchost.exe	61
PID 2716 set thread context of 1636	2716	svchost.exe	62
PID 2716 set thread context of 1684	2716	svchost.exe	63
PID 2716 set thread context of 1504	2716	svchost.exe	64
PID 2716 set thread context of 1356	2716	svchost.exe	65
PID 2716 set thread context of 3004	2716	svchost.exe	66
PID 2716 set thread context of 2360	2716	svchost.exe	67
PID 2716 set thread context of 3024	2716	svchost.exe	68
PID 2716 set thread context of 1604	2716	svchost.exe	69
PID 2716 set thread context of 2068	2716	svchost.exe	70
PID 2716 set thread context of 2348	2716	svchost.exe	71
PID 2716 set thread context of 2160	2716	svchost.exe	72
PID 2716 set thread context of 608	2716	svchost.exe	73
PID 2716 set thread context of 1216	2716	svchost.exe	74
PID 2716 set thread context of 1500	2716	svchost.exe	75
PID 2716 set thread context of 1264	2716	svchost.exe	76
PID 2716 set thread context of 2472	2716	svchost.exe	77
PID 2716 set thread context of 1584	2716	svchost.exe	78
PID 2716 set thread context of 2696	2716	svchost.exe	79
PID 2716 set thread context of 2896	2716	svchost.exe	80
PID 2716 set thread context of 2756	2716	svchost.exe	81
PID 2716 set thread context of 2172	2716	svchost.exe	82
PID 2716 set thread context of 2852	2716	svchost.exe	83
PID 2716 set thread context of 2772	2716	svchost.exe	84
PID 2716 set thread context of 2624	2716	svchost.exe	85
PID 2716 set thread context of 2108	2716	svchost.exe	86
PID 2716 set thread context of 2188	2716	svchost.exe	87
PID 2716 set thread context of 868	2716	svchost.exe	88
PID 2716 set thread context of 2376	2716	svchost.exe	89
PID 2716 set thread context of 1984	2716	svchost.exe	90
PID 2716 set thread context of 2156	2716	svchost.exe	91
PID 2716 set thread context of 536	2716	svchost.exe	92
PID 2716 set thread context of 3064	2716	svchost.exe	93
PID 2716 set thread context of 924	2716	svchost.exe	94
PID 2716 set thread context of 2588	2716	svchost.exe	95
PID 2716 set thread context of 2084	2716	svchost.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2804	reg.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe
2716	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2716	2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	30
PID 2508 wrote to memory of 2716	2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	30
PID 2508 wrote to memory of 2716	2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	30
PID 2508 wrote to memory of 2716	2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	30
PID 2508 wrote to memory of 2716	2508	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	30
PID 2716 wrote to memory of 2824	2716	svchost.exe	31
PID 2716 wrote to memory of 2824	2716	svchost.exe	31
PID 2716 wrote to memory of 2824	2716	svchost.exe	31
PID 2716 wrote to memory of 2824	2716	svchost.exe	31
PID 2716 wrote to memory of 2984	2716	svchost.exe	33
PID 2716 wrote to memory of 2984	2716	svchost.exe	33
PID 2716 wrote to memory of 2984	2716	svchost.exe	33
PID 2716 wrote to memory of 2984	2716	svchost.exe	33
PID 2716 wrote to memory of 2984	2716	svchost.exe	33
PID 2824 wrote to memory of 2804	2824	cmd.exe	34
PID 2824 wrote to memory of 2804	2824	cmd.exe	34
PID 2824 wrote to memory of 2804	2824	cmd.exe	34
PID 2824 wrote to memory of 2804	2824	cmd.exe	34
PID 2716 wrote to memory of 2912	2716	svchost.exe	35
PID 2716 wrote to memory of 2912	2716	svchost.exe	35
PID 2716 wrote to memory of 2912	2716	svchost.exe	35
PID 2716 wrote to memory of 2912	2716	svchost.exe	35
PID 2716 wrote to memory of 2912	2716	svchost.exe	35
PID 2716 wrote to memory of 2744	2716	svchost.exe	36
PID 2716 wrote to memory of 2744	2716	svchost.exe	36
PID 2716 wrote to memory of 2744	2716	svchost.exe	36
PID 2716 wrote to memory of 2744	2716	svchost.exe	36
PID 2716 wrote to memory of 2744	2716	svchost.exe	36
PID 2716 wrote to memory of 2600	2716	svchost.exe	37
PID 2716 wrote to memory of 2600	2716	svchost.exe	37
PID 2716 wrote to memory of 2600	2716	svchost.exe	37
PID 2716 wrote to memory of 2600	2716	svchost.exe	37
PID 2716 wrote to memory of 2600	2716	svchost.exe	37
PID 2716 wrote to memory of 2676	2716	svchost.exe	38
PID 2716 wrote to memory of 2676	2716	svchost.exe	38
PID 2716 wrote to memory of 2676	2716	svchost.exe	38
PID 2716 wrote to memory of 2676	2716	svchost.exe	38
PID 2716 wrote to memory of 2676	2716	svchost.exe	38
PID 2716 wrote to memory of 3056	2716	svchost.exe	39
PID 2716 wrote to memory of 3056	2716	svchost.exe	39
PID 2716 wrote to memory of 3056	2716	svchost.exe	39
PID 2716 wrote to memory of 3056	2716	svchost.exe	39
PID 2716 wrote to memory of 3056	2716	svchost.exe	39
PID 2716 wrote to memory of 2672	2716	svchost.exe	40
PID 2716 wrote to memory of 2672	2716	svchost.exe	40
PID 2716 wrote to memory of 2672	2716	svchost.exe	40
PID 2716 wrote to memory of 2672	2716	svchost.exe	40
PID 2716 wrote to memory of 2672	2716	svchost.exe	40
PID 2716 wrote to memory of 2568	2716	svchost.exe	41
PID 2716 wrote to memory of 2568	2716	svchost.exe	41
PID 2716 wrote to memory of 2568	2716	svchost.exe	41
PID 2716 wrote to memory of 2568	2716	svchost.exe	41
PID 2716 wrote to memory of 2568	2716	svchost.exe	41
PID 2716 wrote to memory of 1996	2716	svchost.exe	42
PID 2716 wrote to memory of 1996	2716	svchost.exe	42
PID 2716 wrote to memory of 1996	2716	svchost.exe	42
PID 2716 wrote to memory of 1996	2716	svchost.exe	42
PID 2716 wrote to memory of 1996	2716	svchost.exe	42
PID 2716 wrote to memory of 1432	2716	svchost.exe	43
PID 2716 wrote to memory of 1432	2716	svchost.exe	43
PID 2716 wrote to memory of 1432	2716	svchost.exe	43
PID 2716 wrote to memory of 1432	2716	svchost.exe	43
PID 2716 wrote to memory of 1432	2716	svchost.exe	43
PID 2716 wrote to memory of 2988	2716	svchost.exe	44

C:\Users\Admin\AppData\Local\Temp\dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
"C:\Users\Admin\AppData\Local\Temp\dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2804
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1708
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:940
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2408
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:648
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:608
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1216
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1584
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2756
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2172
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:868
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:536
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:924
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1896
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-10-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2600-40-0x00000000000C0000-0x00000000000C8000-memory.dmp

Filesize
32KB

Download
memory/2600-43-0x00000000000C0000-0x00000000000C8000-memory.dmp

Filesize
32KB

Download
memory/2600-42-0x00000000000C0000-0x00000000000C8000-memory.dmp

Filesize
32KB

Download
memory/2600-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2676-49-0x0000000000080000-0x0000000000088000-memory.dmp

Filesize
32KB

Download
memory/2716-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2716-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2716-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2716-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2716-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2716-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2716-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2716-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2744-37-0x0000000000080000-0x0000000000088000-memory.dmp

Filesize
32KB

Download
memory/2912-30-0x0000000000080000-0x0000000000088000-memory.dmp

Filesize
32KB

Download
memory/2912-31-0x0000000000080000-0x0000000000088000-memory.dmp

Filesize
32KB

Download
memory/2984-21-0x0000000000080000-0x0000000000088000-memory.dmp

Filesize
32KB

Download
memory/2984-23-0x0000000000080000-0x0000000000088000-memory.dmp

Filesize
32KB

Download
memory/2984-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-24-0x0000000000080000-0x0000000000088000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads