Analysis
-
max time kernel
62s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 01:21
Behavioral task
behavioral1
Sample
3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe
Resource
win10v2004-20240802-en
General
-
Target
3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe
-
Size
2.9MB
-
MD5
067027b5b20d0d80be90f41dc126fda3
-
SHA1
b7644f39188e8e8bcb41723833321a43f9474629
-
SHA256
3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01
-
SHA512
a56fa19a0e6e4263a9d48e17e13ef76084808f98dfba1306feda58f64d92acb15c93794726697982f15cde699874407f7a991138de423eb5fa87b43d5084362a
-
SSDEEP
49152:hh+ZkldoPK8Yad7cwj644Mh+ZkldoPK8YaLDNc9:C2cPK8YwjE2cPK8U
Malware Config
Extracted
webmonitor
snpandey4659.wm01.to:443
-
config_key
sFitr5r1ExCJl86X6inyc4qxlzwyw8fK
-
private_key
t1wG88poq
-
url_path
/recv4.php
Extracted
remcos
2.3.0 Pro
RemoteHost
daya4659.ddns.net:8282
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
3
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-S1KNPZ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor payload 2 IoCs
resource yara_rule behavioral2/memory/4220-21-0x0000000000400000-0x00000000004C0000-memory.dmp family_webmonitor behavioral2/memory/4220-20-0x0000000000400000-0x00000000004C0000-memory.dmp family_webmonitor -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation remcos_agent_Protected.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation remcos_agent_Protected.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation remcos.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation driverquery.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation sfc.exe -
Executes dropped EXE 8 IoCs
pid Process 5020 remcos_agent_Protected.exe 3408 remcos_agent_Protected.exe 2196 remcos.exe 4660 remcos.exe 1628 sfc.exe 4348 driverquery.exe 3672 driverquery.exe 4192 sfc.exe -
resource yara_rule behavioral2/memory/4220-14-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral2/memory/4220-19-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral2/memory/4220-21-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral2/memory/4220-18-0x0000000000400000-0x00000000004C0000-memory.dmp upx behavioral2/memory/4220-20-0x0000000000400000-0x00000000004C0000-memory.dmp upx -
Unexpected DNS network traffic destination 17 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 185.141.152.26 Destination IP 1.2.4.8 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 185.141.152.26 Destination IP 185.141.152.26 Destination IP 185.141.152.26 Destination IP 1.2.4.8 Destination IP 1.2.4.8 Destination IP 1.2.4.8 Destination IP 185.141.152.26 Destination IP 185.141.152.26 Destination IP 185.141.152.26 Destination IP 1.2.4.8 Destination IP 114.114.114.114 Destination IP 185.141.152.26 -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos_agent_Protected.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WebMonitor-7362 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-7362.exe" 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos_agent_Protected.exe -
AutoIT Executable 20 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0008000000023412-4.dat autoit_exe behavioral2/memory/1292-80-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/1292-81-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/928-85-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/1120-87-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/4624-89-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/4484-104-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/1404-189-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/2936-191-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/4220-192-0x00000000009B0000-0x0000000000C9B000-memory.dmp autoit_exe behavioral2/memory/2196-194-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/1964-196-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/2572-198-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/4400-201-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/5092-203-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/2112-208-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/4612-210-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/memory/4864-212-0x0000000000400000-0x0000000000526000-memory.dmp autoit_exe behavioral2/files/0x000700000002341c-239.dat autoit_exe behavioral2/files/0x0007000000023419-241.dat autoit_exe -
Suspicious use of SetThreadContext 30 IoCs
description pid Process procid_target PID 4824 set thread context of 4220 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 92 PID 5020 set thread context of 3408 5020 remcos_agent_Protected.exe 97 PID 2196 set thread context of 4660 2196 remcos.exe 115 PID 4660 set thread context of 1292 4660 remcos.exe 116 PID 4660 set thread context of 928 4660 remcos.exe 124 PID 4660 set thread context of 1120 4660 remcos.exe 127 PID 4660 set thread context of 4624 4660 remcos.exe 130 PID 4660 set thread context of 4484 4660 remcos.exe 133 PID 4660 set thread context of 1404 4660 remcos.exe 136 PID 4660 set thread context of 2936 4660 remcos.exe 139 PID 4660 set thread context of 2196 4660 remcos.exe 142 PID 4660 set thread context of 1964 4660 remcos.exe 146 PID 4660 set thread context of 2572 4660 remcos.exe 151 PID 4660 set thread context of 4400 4660 remcos.exe 154 PID 4660 set thread context of 5092 4660 remcos.exe 158 PID 4660 set thread context of 2112 4660 remcos.exe 161 PID 4660 set thread context of 4612 4660 remcos.exe 165 PID 4660 set thread context of 4864 4660 remcos.exe 168 PID 4660 set thread context of 456 4660 remcos.exe 171 PID 4660 set thread context of 224 4660 remcos.exe 176 PID 4660 set thread context of 1996 4660 remcos.exe 179 PID 4660 set thread context of 3088 4660 remcos.exe 184 PID 4660 set thread context of 3452 4660 remcos.exe 187 PID 4660 set thread context of 2676 4660 remcos.exe 190 PID 4660 set thread context of 3664 4660 remcos.exe 193 PID 4660 set thread context of 4468 4660 remcos.exe 196 PID 4660 set thread context of 3488 4660 remcos.exe 199 PID 4348 set thread context of 3672 4348 driverquery.exe 204 PID 4660 set thread context of 3192 4660 remcos.exe 207 PID 1628 set thread context of 4192 1628 sfc.exe 210 -
HTTP links in PDF interactive object 2 IoCs
Detects HTTP links in interactive objects within PDF files.
resource yara_rule behavioral2/files/0x0007000000023418-13.dat pdf_with_link_action behavioral2/files/0x0007000000023419-241.dat pdf_with_link_action -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 25 IoCs
pid pid_target Process procid_target 3920 1292 WerFault.exe 116 3048 928 WerFault.exe 124 3040 1120 WerFault.exe 127 4796 4624 WerFault.exe 130 4612 4484 WerFault.exe 133 4984 1404 WerFault.exe 136 2832 2936 WerFault.exe 139 4136 2196 WerFault.exe 142 3836 1964 WerFault.exe 146 2616 2572 WerFault.exe 151 3792 4400 WerFault.exe 154 1628 5092 WerFault.exe 158 3088 2112 WerFault.exe 161 4512 4612 WerFault.exe 165 3576 4864 WerFault.exe 168 632 456 WerFault.exe 171 1568 224 WerFault.exe 176 4392 1996 WerFault.exe 179 3516 3088 WerFault.exe 184 4188 3452 WerFault.exe 187 4932 2676 WerFault.exe 190 4628 3664 WerFault.exe 193 808 4468 WerFault.exe 196 4004 3488 WerFault.exe 199 1156 3192 WerFault.exe 207 -
System Location Discovery: System Language Discovery 1 TTPs 49 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos_agent_Protected.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language driverquery.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language driverquery.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos_agent_Protected.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings remcos_agent_Protected.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4668 schtasks.exe 4192 schtasks.exe 4596 schtasks.exe 4348 schtasks.exe 4728 schtasks.exe 1736 schtasks.exe 3432 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4220 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1864 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 1864 AcroRd32.exe 4660 remcos.exe 1864 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 5020 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 86 PID 4824 wrote to memory of 5020 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 86 PID 4824 wrote to memory of 5020 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 86 PID 4824 wrote to memory of 1864 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 88 PID 4824 wrote to memory of 1864 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 88 PID 4824 wrote to memory of 1864 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 88 PID 4824 wrote to memory of 4012 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 89 PID 4824 wrote to memory of 4012 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 89 PID 4824 wrote to memory of 4012 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 89 PID 4824 wrote to memory of 3576 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 90 PID 4824 wrote to memory of 3576 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 90 PID 4824 wrote to memory of 3576 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 90 PID 4824 wrote to memory of 2080 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 91 PID 4824 wrote to memory of 2080 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 91 PID 4824 wrote to memory of 2080 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 91 PID 4824 wrote to memory of 4220 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 92 PID 4824 wrote to memory of 4220 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 92 PID 4824 wrote to memory of 4220 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 92 PID 4824 wrote to memory of 4220 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 92 PID 4824 wrote to memory of 4220 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 92 PID 4824 wrote to memory of 4192 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 93 PID 4824 wrote to memory of 4192 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 93 PID 4824 wrote to memory of 4192 4824 3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe 93 PID 5020 wrote to memory of 3408 5020 remcos_agent_Protected.exe 97 PID 5020 wrote to memory of 3408 5020 remcos_agent_Protected.exe 97 PID 5020 wrote to memory of 3408 5020 remcos_agent_Protected.exe 97 PID 5020 wrote to memory of 3408 5020 remcos_agent_Protected.exe 97 PID 5020 wrote to memory of 3408 5020 remcos_agent_Protected.exe 97 PID 3408 wrote to memory of 2308 3408 remcos_agent_Protected.exe 98 PID 3408 wrote to memory of 2308 3408 remcos_agent_Protected.exe 98 PID 3408 wrote to memory of 2308 3408 remcos_agent_Protected.exe 98 PID 5020 wrote to memory of 4596 5020 remcos_agent_Protected.exe 99 PID 5020 wrote to memory of 4596 5020 remcos_agent_Protected.exe 99 PID 5020 wrote to memory of 4596 5020 remcos_agent_Protected.exe 99 PID 2308 wrote to memory of 2324 2308 WScript.exe 103 PID 2308 wrote to memory of 2324 2308 WScript.exe 103 PID 2308 wrote to memory of 2324 2308 WScript.exe 103 PID 2324 wrote to memory of 2196 2324 cmd.exe 105 PID 2324 wrote to memory of 2196 2324 cmd.exe 105 PID 2324 wrote to memory of 2196 2324 cmd.exe 105 PID 1864 wrote to memory of 3264 1864 AcroRd32.exe 106 PID 1864 wrote to memory of 3264 1864 AcroRd32.exe 106 PID 1864 wrote to memory of 3264 1864 AcroRd32.exe 106 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107 PID 3264 wrote to memory of 1692 3264 RdrCEF.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"C:\Users\Admin\AppData\Roaming\remcos_agent_Protected.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exeC:\Users\Admin\AppData\Roaming\remcos\remcos.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4660 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:1292 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 5769⤵
- Program crash
PID:3920
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1929⤵
- Program crash
PID:3048
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:1120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 5609⤵
- Program crash
PID:3040
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:4624 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 5609⤵
- Program crash
PID:4796
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 5969⤵
- Program crash
PID:4612
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:1404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 5649⤵
- Program crash
PID:4984
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 2289⤵
- Program crash
PID:2832
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 2089⤵
- Program crash
PID:4136
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:916
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 5689⤵
- Program crash
PID:3836
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4620
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2296
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:2572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 5609⤵
- Program crash
PID:2616
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:4400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 5609⤵
- Program crash
PID:3792
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 1929⤵
- Program crash
PID:1628
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 5609⤵
- Program crash
PID:3088
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 2129⤵
- Program crash
PID:4512
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:4864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 5609⤵
- Program crash
PID:3576
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 5649⤵
- Program crash
PID:632
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4980
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1088
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 5609⤵
- Program crash
PID:1568
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 5609⤵
- Program crash
PID:4392
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4872
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1540
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 5649⤵
- Program crash
PID:3516
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:3452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 2009⤵
- Program crash
PID:4188
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 5609⤵
- Program crash
PID:4932
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:3664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 5609⤵
- Program crash
PID:4628
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 5609⤵
- Program crash
PID:808
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:3488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 5609⤵
- Program crash
PID:4004
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵
- System Location Discovery: System Language Discovery
PID:3192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 5689⤵
- Program crash
PID:1156
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F7⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4348
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4596
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\medical-application-form.pdf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=38E0AC1278AB28164564502AEC719024 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:1692
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FD04FA19B0A978456D678766D603DB04 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FD04FA19B0A978456D678766D603DB04 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:4924
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4064ACB14660DD87B68497D58520AC5A --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:1368
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=79207EAD2AE2F7CADC78DB8635DAF6A5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=79207EAD2AE2F7CADC78DB8635DAF6A5 --renderer-client-id=5 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:4240
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3DD458A74F2AB662296C7EBDF6D93611 --mojo-platform-channel-handle=2672 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3560
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E002EE61D3B461B378876CD30A10A252 --mojo-platform-channel-handle=1992 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"2⤵PID:4012
-
-
C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"2⤵PID:3576
-
-
C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"2⤵PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"C:\Users\Admin\AppData\Local\Temp\3b41f447509a77d0c3155f23928457be0f71701c490af674f03da959e984ac01.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:4220
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4192
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1292 -ip 12921⤵PID:208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 928 -ip 9281⤵PID:1504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1120 -ip 11201⤵PID:2080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4624 -ip 46241⤵PID:3488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4484 -ip 44841⤵PID:1236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1404 -ip 14041⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2936 -ip 29361⤵PID:208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2196 -ip 21961⤵PID:2532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1964 -ip 19641⤵PID:4380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2572 -ip 25721⤵PID:4336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4400 -ip 44001⤵PID:3952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5092 -ip 50921⤵PID:4808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2112 -ip 21121⤵PID:744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4612 -ip 46121⤵PID:1000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4864 -ip 48641⤵PID:3100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 456 -ip 4561⤵PID:2080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 224 -ip 2241⤵PID:3372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1996 -ip 19961⤵PID:4312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3088 -ip 30881⤵PID:2996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3452 -ip 34521⤵PID:5068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2676 -ip 26761⤵PID:2368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3664 -ip 36641⤵PID:4308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4468 -ip 44681⤵PID:3952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3488 -ip 34881⤵PID:3480
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:4192
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1736
-
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exeC:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3672
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3192 -ip 31921⤵PID:2960
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exeC:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe1⤵PID:1920
-
C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe"2⤵PID:2588
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn WWAHost /tr "C:\Users\Admin\AppData\Roaming\RtDCpl64\driverquery.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:3432
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵PID:5068
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵PID:3916
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:4668
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
64KB
MD56bbf2fd7e7696f2883b6459059d4066d
SHA1bda3fd6ab1d20b45a1f658f51df06a09889c957b
SHA256d92a0881b71164ac5e13fae30c1fbc04c1f854fa46fca110673c93e1c94b9417
SHA51249c9696826c1867475461714b252de5a407346efabfa80348f7d14a63e95bcea697b5da3a6f94cea45b11e6070186f964bfdb46f8a9df4260039898177e18dfe
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
418B
MD5ff449f6f7bc5e2d800eb30e2d2c56611
SHA193419ea805b9ce35a766e5c56db50d54c2d3f94b
SHA256655787cf79040ee701963986320556a834d6345e850e03653e4852d94eb09416
SHA51202a17064c837d36ba241fb8edf9266e33479a10eb8652b974158a3227878a801da29db1108413bb2c298a105b3c19bd20c3a3100f19444189f434706825766a6
-
Filesize
340KB
MD5bb0aa1bade4df17033a05d8d682b44d2
SHA1bec4b0a8a7413d158cf6705a3c888bdf36a4371b
SHA25696d6c8c54390b476e8f8f42b99b52efb19eca152bf046c254992bc2f2faba764
SHA5126bfe1b289f9c84d4db5a564ed129f7920775946981d5da5cb7753d63a141d84486ba9e958044e8162fba2eba875e56c358f92091b760e07b8cbe459e4202e4d9
-
Filesize
1.1MB
MD5ceb1ccb24967d31ec7c4ac1aee82afbd
SHA1daa2bb097446f4a66fd2dc346465f6cd9ff49e2b
SHA2567c88dbe6c9c0a38ba3d09483e915cae9e1f73546f271b2f741ea3ed8781f9639
SHA5123aea1338a3e26d6e91c5f683c899bcb9e0a6469d294ed7938d1922a09f3b2a57483fbf1fbecb170f2f2e07c1035f0ca9418171483987be712a3eec830f2c97d7
-
Filesize
2.9MB
MD554ab36dc04263d956b36e4cb55a391aa
SHA1f595ff0af54ab6bfdea2f3e44e3511a26b98460d
SHA256ae3b64c6e9018feddd5c987f35f7397af2556e2d4b010159cbd8172cd7400c40
SHA5120bb1279aac67c56794cea53b083bb7b82edbc399f95f8a45269ecf893f9c5af55a1c0cec7f421184c8862196f4b132049315a203dbef32cf778aa56030e32f3a
-
Filesize
118B
MD53a206e64c0ee5ddf3950a7dbdc60c420
SHA1faa0dbeef653bc3229626839b64dee6da5e96d1e
SHA2568ca5c6792af5a693d3e3bda299ac2b9b747501a2176fd8384a8bd527c1f0c230
SHA51245b1ad5b207d0d90148b173953f725541cf087b1340b784adffe5bb1d10235bafe66a8d8261a024a7f462cc6154908bc81df99fcd2f2dd22a8e4fd66717b59f8
-
Filesize
1.1MB
MD5d5581c9db64b399c7d0cdb3f7b78673b
SHA187396211e6468d73c97301fe0b673f64bcd6d17c
SHA2567210f2ca290296d1f6e61da4b3192ad19afd719d6cf77dbb2d6810734b349826
SHA5125a8034902bfd110826aebc8196469f0dea26d94fcb093406342657b9660f400cc495a6a7ce843d32a7541083cfbc3f0fbdf9aab1ad08294729307bffe7c512c6