remcos | hxxps://docs[.]google[.]com/uc?export=download&id=1-2JRN5sDp8g8FsY2l_IYJ8EdgUN2Aaie

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/uc?export=download&id=1-2JRN5sDp8g8FsY2l_IYJ8EdgUN2Aaie

Score

10^/10

remcos enfocadoe discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

ENFOCADOE

agosto21.con-ip.com:7775

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7BZCZN
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
4856	1162OfxSentent1aTutelaRadicado2024-00119.exe
5004	1162OfxSentent1aTutelaRadicado2024-00119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webex = "C:\\Users\\Admin\\Pictures\\Webex\\WebexMeetingClient.exe"	1162OfxSentent1aTutelaRadicado2024-00119.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1162OfxSentent1aTutelaRadicado2024-00119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1162OfxSentent1aTutelaRadicado2024-00119.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\shell\open\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\shell	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\shell\open	7zFM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\.gz	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\DefaultIcon	7zFM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\ = "gz Archive"	7zFM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\shell\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\shell\open\command	7zFM.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\shell\open	7zFM.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz	7zFM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\.gz\ = "7-Zip.gz"	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz	7zFM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,14"	7zFM.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_CLASSES\7-ZIP.GZ\SHELL\OPEN\COMMAND	7zFM.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\7-Zip.gz\shell	7zFM.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2804	msedge.exe
2804	msedge.exe
4016	identity_helper.exe
4016	identity_helper.exe
4036	msedge.exe
4036	msedge.exe
3936	7zFM.exe
3936	7zFM.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2192	7zFM.exe
Token: 35	2192	7zFM.exe
Token: SeRestorePrivilege	3936	7zFM.exe
Token: 35	3936	7zFM.exe
Token: SeSecurityPrivilege	3936	7zFM.exe
Token: SeDebugPrivilege	1000	taskmgr.exe
Token: SeSystemProfilePrivilege	1000	taskmgr.exe
Token: SeCreateGlobalPrivilege	1000	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
3936	7zFM.exe
3936	7zFM.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe
1000	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5004	1162OfxSentent1aTutelaRadicado2024-00119.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1912	2804	msedge.exe	83
PID 2804 wrote to memory of 1912	2804	msedge.exe	83
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2400	2804	msedge.exe	84
PID 2804 wrote to memory of 2920	2804	msedge.exe	85
PID 2804 wrote to memory of 2920	2804	msedge.exe	85
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86
PID 2804 wrote to memory of 3632	2804	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.google.com/uc?export=download&id=1-2JRN5sDp8g8FsY2l_IYJ8EdgUN2Aaie
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15f846f8,0x7ffd15f84708,0x7ffd15f84718
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16534313486404080167,2778880723757493069,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4568

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\1162OfxSentent1aTutelaRadicado2024-00119.tar.gz"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3936
- C:\Users\Admin\AppData\Local\Temp\7zO06FA92C8\1162OfxSentent1aTutelaRadicado2024-00119.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO06FA92C8\1162OfxSentent1aTutelaRadicado2024-00119.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\7zO06FA92C8\1162OfxSentent1aTutelaRadicado2024-00119.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO06FA92C8\1162OfxSentent1aTutelaRadicado2024-00119.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5004

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
296B

MD5
9b6b4667c0c29ab4a84251f3f0de7d94

SHA1
fd79b5d9d04c361e5131a269bfb3954c3eecde63

SHA256
d32f70e998bd28b67fadfb4ed20f749abd12cc09681ce1519e41ba1e62f25811

SHA512
7af217de78d96d39e34ed776cfe0f1f9a88bc041a8f056930903400b38d5d293fcbff7d927e067b4a77f5bc71f49b34c23ed5b70d9008c9c57c4a7474d517368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60e7911c-bffd-4637-9fce-c3db581ce5a5.tmp

Filesize
5KB

MD5
b581036163961ee613dc5dc5e4891575

SHA1
29841dd1e408282bbd0f86ba0ca5e7e9de8a8a4b

SHA256
40b851b01017b8976d7dbfb25605cf43748b15156f75941e991cb6fac3644ae7

SHA512
e6581fb184ee21a37a3ebcf17f04dda5fca6e25dfc88eef0095768d990f144f4f86ea205a1c4c4b518feddd11bcd7b0b90edd768e18df74f55a6bf6555915021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
796B

MD5
b9a9fe183d6ee2390bed86e34fa8fa25

SHA1
44403c6201da5078b891cc970d2efe2ae01196d0

SHA256
35b60f2f53f685f6eacf5878e0b6eb119d9d89ec43debeb436b6d116e3d45041

SHA512
a82767a3391e9db80b0b8de901be86413bbfba1dca5395ec03733b8c9bd739c958bf6ccd9c0cd8a10fd78b94de228afc28e7860d8aaeae836d8eb331d48559b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0db32cfd9944167671c5c25c170ec81

SHA1
0af4961dad2227fc8459caa4313079eb9aa6701b

SHA256
39cd0038c78c6449b905414a695bf7bff4f2500ba08f0b7431f304dd3b1772e8

SHA512
7b409f1c93f1c3d482955986795a20698dd3b52264b28fff794d88b44afa979204c6a0bf556eb35d9c01d98cb288b2c312e85c166a474fcc44af05f808ac4f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24142469fd02fa513029e6bf73307572

SHA1
42a018b41d615f19ec337aaddad997f43d7828bd

SHA256
bd8bbaedc1712b0fecd8bd7a2f9778bf1423ea6c06dceaf3a7391c8775e8cacb

SHA512
2d1834f87450dd9b3ef149f98ce1ff72de2eab1cb8ae751a2533561bad9a44f80726366d73cfaeb6aabdbd0e7a5ee6ee0b65faa0c7e07c96827d05d6400320a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
96bdd28f09bd2ac4d30d8b624f2cb791

SHA1
8e4e18e1194758fc1dd859ad4119b57b8c7c8295

SHA256
77ea240104f2edf3abcbe9eeb83083039e9fdf291918fa1303458b2cc1a0d1e5

SHA512
8959991887718c78db3b66904e733610e1d599cd3344077bed8ca88332615cd5e0a11e8fe8f528a7c71a58386f414ff7aede730a28a4ca8646e5e5daf4e8157e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d307f64e34708728bab32e312617d7b

SHA1
00b7ed9710a54786046a4998fb93014aa3ce4c71

SHA256
79fd448a210a0b5b0cf99be32ebed67a0883a7c1ec39796df3905a7d0916ef62

SHA512
efef40cb915ca6774dc3abd078252d2bd81cb874e6cfcb5b66e5fad96a01bbd6808a0dd292998efe409ed9d670be13b5d82769b6266e1b93ee21314c6cb882d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
db1ac3af0cac336c2e965b9fc2bc7839

SHA1
519319987e49a551dd49ebe5df4ae9c4a7a80344

SHA256
0f587fa35c0a3ed666e28ff9d4ee7953383e12beac7957d366df6477dc743880

SHA512
0c9796daac334794376ad2395992c695feeb1b82858493ec3b960dc14625e81faf570f7f3ab8ec832d9d81f01ee43ad87270b5607a6792a485de618da5b55367

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO06FA92C8\1162OfxSentent1aTutelaRadicado2024-00119.exe

Filesize
3.6MB

MD5
88b93c9f46399e63c0c713211077d4cd

SHA1
b30086dba9cc981226a3e36d593e5bf69a0954b9

SHA256
0fe731eac32f92d3da0c90f990e37205a99e374f715902a469524205092bf951

SHA512
f5ce76651ccd514b60402937853a569762e799c41d814898b0ffe50efb86ba81fe75a79069d984b9b8fd469363aa5523be03227ea211efbbc57cbd5ffbe93cbf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 840388.crdownload

Filesize
1.4MB

MD5
ee5886a57444e9763977d94183ea5909

SHA1
11c961de17fdb2e46779a619735d1e88797b6c11

SHA256
a665fd6b1f05594b4316109d92a5f468ffc1bd5974c0137488bbd2cff9fc37ec

SHA512
4bd72a19ebe825e5cb1db6db2daa11be5ff98cd93f7a4c56617b29f9e1794a92d5e673675b10958626c59ca425956f663290051c3cc2dfb6b5050f1190383cf0

Download Submit
memory/1000-163-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/1000-167-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/1000-165-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/1000-166-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/1000-168-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/1000-169-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/1000-159-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/1000-158-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/1000-157-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/1000-164-0x00000231109B0000-0x00000231109B1000-memory.dmp

Filesize
4KB

Download
memory/4856-148-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/4856-146-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/5004-147-0x00000000007C0000-0x0000000000842000-memory.dmp

Filesize
520KB

Download
memory/5004-155-0x00000000007C0000-0x0000000000842000-memory.dmp

Filesize
520KB

Download
memory/5004-154-0x00000000007C0000-0x0000000000842000-memory.dmp

Filesize
520KB

Download
memory/5004-150-0x00000000007C0000-0x0000000000842000-memory.dmp

Filesize
520KB

Download
memory/5004-151-0x00000000007C0000-0x0000000000842000-memory.dmp

Filesize
520KB

Download
memory/5004-179-0x00000000007C0000-0x0000000000842000-memory.dmp

Filesize
520KB

Download
memory/5004-180-0x00000000007C0000-0x0000000000842000-memory.dmp

Filesize
520KB

Download