remcos | dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
Size

1.3MB
MD5

e3504f07ea46e8c5ce1321b44e752556
SHA1

e5c612e6de7696296a13a5c59ee1712084559919
SHA256

dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e
SHA512

5aeb6baa9d02cdcfed6a02301bce02460b4b68c06ef3e9038bb4b1ba01ce3ad4884a5271653352527c625801519cfcfffdd9c1d03e005dbe3c21d3b460c4db5d
SSDEEP

24576:qAHnh+eWsN3skA4RV1Hom2KXMmHaYMCcRJjERtK/cfrWIlcf6NyEi5:9h+ZkldoPK8YaYrc/jYK/cf6YcCM

Score

10^/10

remcos dorobumajor discovery evasion rat trojan

Malware Config

Extracted

Family

remcos

Botnet

dorobumajor

84.38.132.40:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
testhostex.exe
copy_folder
dorbion
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WBALP5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3656 set thread context of 4412	3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	91
PID 4412 set thread context of 3936	4412	svchost.exe	94
PID 4412 set thread context of 2804	4412	svchost.exe	98
PID 4412 set thread context of 5092	4412	svchost.exe	100
PID 4412 set thread context of 2040	4412	svchost.exe	101
PID 4412 set thread context of 2544	4412	svchost.exe	104
PID 4412 set thread context of 3548	4412	svchost.exe	105
PID 4412 set thread context of 2488	4412	svchost.exe	106
PID 4412 set thread context of 4820	4412	svchost.exe	107
PID 4412 set thread context of 2668	4412	svchost.exe	108
PID 4412 set thread context of 1880	4412	svchost.exe	109
PID 4412 set thread context of 3704	4412	svchost.exe	110
PID 4412 set thread context of 4048	4412	svchost.exe	111
PID 4412 set thread context of 4284	4412	svchost.exe	112
PID 4412 set thread context of 4460	4412	svchost.exe	113
PID 4412 set thread context of 3780	4412	svchost.exe	115
PID 4412 set thread context of 3760	4412	svchost.exe	116
PID 4412 set thread context of 612	4412	svchost.exe	119
PID 4412 set thread context of 2216	4412	svchost.exe	120
PID 4412 set thread context of 2152	4412	svchost.exe	121
PID 4412 set thread context of 3988	4412	svchost.exe	122
PID 4412 set thread context of 5012	4412	svchost.exe	123
PID 4412 set thread context of 3616	4412	svchost.exe	124
PID 4412 set thread context of 4036	4412	svchost.exe	125
PID 4412 set thread context of 1232	4412	svchost.exe	126
PID 4412 set thread context of 4564	4412	svchost.exe	127
PID 4412 set thread context of 1504	4412	svchost.exe	128
PID 4412 set thread context of 1032	4412	svchost.exe	129
PID 4412 set thread context of 3980	4412	svchost.exe	130
PID 4412 set thread context of 1656	4412	svchost.exe	131
PID 4412 set thread context of 1220	4412	svchost.exe	132
PID 4412 set thread context of 2708	4412	svchost.exe	133
PID 4412 set thread context of 3224	4412	svchost.exe	134
PID 4412 set thread context of 4172	4412	svchost.exe	136
PID 4412 set thread context of 348	4412	svchost.exe	137
PID 4412 set thread context of 1324	4412	svchost.exe	138
PID 4412 set thread context of 2028	4412	svchost.exe	139
PID 4412 set thread context of 4684	4412	svchost.exe	140
PID 4412 set thread context of 4292	4412	svchost.exe	141
PID 4412 set thread context of 1488	4412	svchost.exe	142
PID 4412 set thread context of 3728	4412	svchost.exe	143
PID 4412 set thread context of 4964	4412	svchost.exe	144
PID 4412 set thread context of 4256	4412	svchost.exe	145
PID 4412 set thread context of 3336	4412	svchost.exe	146
PID 4412 set thread context of 4404	4412	svchost.exe	147
PID 4412 set thread context of 4988	4412	svchost.exe	148
PID 4412 set thread context of 3964	4412	svchost.exe	149
PID 4412 set thread context of 4452	4412	svchost.exe	150
PID 4412 set thread context of 3932	4412	svchost.exe	151
PID 4412 set thread context of 1908	4412	svchost.exe	156
PID 4412 set thread context of 1916	4412	svchost.exe	157
PID 4412 set thread context of 3604	4412	svchost.exe	162
PID 4412 set thread context of 1556	4412	svchost.exe	163
PID 4412 set thread context of 4384	4412	svchost.exe	164
PID 4412 set thread context of 1632	4412	svchost.exe	165
PID 4412 set thread context of 1640	4412	svchost.exe	166
PID 4412 set thread context of 3428	4412	svchost.exe	167
PID 4412 set thread context of 3200	4412	svchost.exe	168
PID 4412 set thread context of 4840	4412	svchost.exe	169
PID 4412 set thread context of 3976	4412	svchost.exe	170
PID 4412 set thread context of 4800	4412	svchost.exe	171
PID 4412 set thread context of 1508	4412	svchost.exe	172
PID 4412 set thread context of 2280	4412	svchost.exe	173
PID 4412 set thread context of 2112	4412	svchost.exe	174

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3632	reg.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe
4412	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 4376	2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	87
PID 2684 wrote to memory of 4376	2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	87
PID 2684 wrote to memory of 4376	2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	87
PID 2684 wrote to memory of 3656	2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	88
PID 2684 wrote to memory of 3656	2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	88
PID 2684 wrote to memory of 3656	2684	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	88
PID 3656 wrote to memory of 4412	3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	91
PID 3656 wrote to memory of 4412	3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	91
PID 3656 wrote to memory of 4412	3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	91
PID 3656 wrote to memory of 4412	3656	dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe	91
PID 4412 wrote to memory of 4396	4412	svchost.exe	92
PID 4412 wrote to memory of 4396	4412	svchost.exe	92
PID 4412 wrote to memory of 4396	4412	svchost.exe	92
PID 4412 wrote to memory of 3936	4412	svchost.exe	94
PID 4412 wrote to memory of 3936	4412	svchost.exe	94
PID 4412 wrote to memory of 3936	4412	svchost.exe	94
PID 4412 wrote to memory of 3936	4412	svchost.exe	94
PID 4396 wrote to memory of 3632	4396	cmd.exe	95
PID 4396 wrote to memory of 3632	4396	cmd.exe	95
PID 4396 wrote to memory of 3632	4396	cmd.exe	95
PID 4412 wrote to memory of 2804	4412	svchost.exe	98
PID 4412 wrote to memory of 2804	4412	svchost.exe	98
PID 4412 wrote to memory of 2804	4412	svchost.exe	98
PID 4412 wrote to memory of 2804	4412	svchost.exe	98
PID 4412 wrote to memory of 5092	4412	svchost.exe	100
PID 4412 wrote to memory of 5092	4412	svchost.exe	100
PID 4412 wrote to memory of 5092	4412	svchost.exe	100
PID 4412 wrote to memory of 5092	4412	svchost.exe	100
PID 4412 wrote to memory of 2040	4412	svchost.exe	101
PID 4412 wrote to memory of 2040	4412	svchost.exe	101
PID 4412 wrote to memory of 2040	4412	svchost.exe	101
PID 4412 wrote to memory of 2040	4412	svchost.exe	101
PID 4412 wrote to memory of 2544	4412	svchost.exe	104
PID 4412 wrote to memory of 2544	4412	svchost.exe	104
PID 4412 wrote to memory of 2544	4412	svchost.exe	104
PID 4412 wrote to memory of 2544	4412	svchost.exe	104
PID 4412 wrote to memory of 3548	4412	svchost.exe	105
PID 4412 wrote to memory of 3548	4412	svchost.exe	105
PID 4412 wrote to memory of 3548	4412	svchost.exe	105
PID 4412 wrote to memory of 3548	4412	svchost.exe	105
PID 4412 wrote to memory of 2488	4412	svchost.exe	106
PID 4412 wrote to memory of 2488	4412	svchost.exe	106
PID 4412 wrote to memory of 2488	4412	svchost.exe	106
PID 4412 wrote to memory of 2488	4412	svchost.exe	106
PID 4412 wrote to memory of 4820	4412	svchost.exe	107
PID 4412 wrote to memory of 4820	4412	svchost.exe	107
PID 4412 wrote to memory of 4820	4412	svchost.exe	107
PID 4412 wrote to memory of 4820	4412	svchost.exe	107
PID 4412 wrote to memory of 2668	4412	svchost.exe	108
PID 4412 wrote to memory of 2668	4412	svchost.exe	108
PID 4412 wrote to memory of 2668	4412	svchost.exe	108
PID 4412 wrote to memory of 2668	4412	svchost.exe	108
PID 4412 wrote to memory of 1880	4412	svchost.exe	109
PID 4412 wrote to memory of 1880	4412	svchost.exe	109
PID 4412 wrote to memory of 1880	4412	svchost.exe	109
PID 4412 wrote to memory of 1880	4412	svchost.exe	109
PID 4412 wrote to memory of 3704	4412	svchost.exe	110
PID 4412 wrote to memory of 3704	4412	svchost.exe	110
PID 4412 wrote to memory of 3704	4412	svchost.exe	110
PID 4412 wrote to memory of 3704	4412	svchost.exe	110
PID 4412 wrote to memory of 4048	4412	svchost.exe	111
PID 4412 wrote to memory of 4048	4412	svchost.exe	111
PID 4412 wrote to memory of 4048	4412	svchost.exe	111
PID 4412 wrote to memory of 4048	4412	svchost.exe	111

C:\Users\Admin\AppData\Local\Temp\dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
"C:\Users\Admin\AppData\Local\Temp\dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe"
  2⤵
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe
  "C:\Users\Admin\AppData\Local\Temp\dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\dfc8e10de69f490f19664c753862ed95466195dfc45dae4f8b43a11565b2cc8e.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3632
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3936
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:5092
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2040
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3548
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2488
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4820
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3704
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4048
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4284
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4460
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3780
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3760
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:612
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2216
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2152
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:5012
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3616
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4036
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1232
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4564
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1032
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3980
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1220
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2708
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3224
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4172
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:348
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1324
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4684
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4292
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1488
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3728
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4964
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4256
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3336
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4404
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4988
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3964
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3932
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1916
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3604
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1556
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4384
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3428
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3200
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3976
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2112
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:456
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:116
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3984
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:5028
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3496
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4212
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3124
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:3868
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-89-0x0000000000350000-0x000000000035E000-memory.dmp

Filesize
56KB

Download
memory/612-88-0x0000000000350000-0x000000000035E000-memory.dmp

Filesize
56KB

Download
memory/612-87-0x0000000000350000-0x000000000035E000-memory.dmp

Filesize
56KB

Download
memory/1880-66-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/1880-65-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/1880-64-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/2040-47-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/2040-46-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/2040-45-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/2216-91-0x0000000000F20000-0x0000000000F2E000-memory.dmp

Filesize
56KB

Download
memory/2216-90-0x0000000000F20000-0x0000000000F2E000-memory.dmp

Filesize
56KB

Download
memory/2488-55-0x00000000001A0000-0x00000000001AE000-memory.dmp

Filesize
56KB

Download
memory/2488-57-0x00000000001A0000-0x00000000001AE000-memory.dmp

Filesize
56KB

Download
memory/2488-56-0x00000000001A0000-0x00000000001AE000-memory.dmp

Filesize
56KB

Download
memory/2544-51-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/2544-49-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/2544-50-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/2668-61-0x0000000000B80000-0x0000000000B8E000-memory.dmp

Filesize
56KB

Download
memory/2668-62-0x0000000000B80000-0x0000000000B8E000-memory.dmp

Filesize
56KB

Download
memory/2668-63-0x0000000000B80000-0x0000000000B8E000-memory.dmp

Filesize
56KB

Download
memory/2684-10-0x0000000000B70000-0x0000000000B74000-memory.dmp

Filesize
16KB

Download
memory/2804-41-0x0000000001070000-0x000000000107E000-memory.dmp

Filesize
56KB

Download
memory/2804-40-0x0000000001070000-0x000000000107E000-memory.dmp

Filesize
56KB

Download
memory/2804-38-0x0000000001070000-0x000000000107E000-memory.dmp

Filesize
56KB

Download
memory/2804-37-0x0000000001070000-0x000000000107E000-memory.dmp

Filesize
56KB

Download
memory/3548-54-0x0000000001230000-0x000000000123E000-memory.dmp

Filesize
56KB

Download
memory/3548-53-0x0000000001230000-0x000000000123E000-memory.dmp

Filesize
56KB

Download
memory/3548-52-0x0000000001230000-0x000000000123E000-memory.dmp

Filesize
56KB

Download
memory/3704-67-0x0000000000450000-0x000000000045E000-memory.dmp

Filesize
56KB

Download
memory/3704-69-0x0000000000450000-0x000000000045E000-memory.dmp

Filesize
56KB

Download
memory/3704-68-0x0000000000450000-0x000000000045E000-memory.dmp

Filesize
56KB

Download
memory/3760-86-0x00000000007A0000-0x00000000007AE000-memory.dmp

Filesize
56KB

Download
memory/3760-85-0x00000000007A0000-0x00000000007AE000-memory.dmp

Filesize
56KB

Download
memory/3760-84-0x00000000007A0000-0x00000000007AE000-memory.dmp

Filesize
56KB

Download
memory/3780-81-0x0000000000960000-0x000000000096E000-memory.dmp

Filesize
56KB

Download
memory/3780-82-0x0000000000960000-0x000000000096E000-memory.dmp

Filesize
56KB

Download
memory/3780-83-0x0000000000960000-0x000000000096E000-memory.dmp

Filesize
56KB

Download
memory/3936-32-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/3936-35-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/3936-36-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/3936-34-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/3936-31-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/4048-74-0x0000000000810000-0x000000000081E000-memory.dmp

Filesize
56KB

Download
memory/4048-72-0x0000000000810000-0x000000000081E000-memory.dmp

Filesize
56KB

Download
memory/4048-73-0x0000000000810000-0x000000000081E000-memory.dmp

Filesize
56KB

Download
memory/4284-76-0x0000000001260000-0x000000000126E000-memory.dmp

Filesize
56KB

Download
memory/4284-77-0x0000000001260000-0x000000000126E000-memory.dmp

Filesize
56KB

Download
memory/4284-75-0x0000000001260000-0x000000000126E000-memory.dmp

Filesize
56KB

Download
memory/4412-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4412-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4412-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4412-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4412-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4412-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4412-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4412-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4412-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4460-79-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/4460-78-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/4460-80-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/4820-58-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/4820-59-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/4820-60-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/5092-44-0x0000000001210000-0x000000000121E000-memory.dmp

Filesize
56KB

Download
memory/5092-43-0x0000000001210000-0x000000000121E000-memory.dmp

Filesize
56KB

Download
memory/5092-42-0x0000000001210000-0x000000000121E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads