remcos | 6a65415e83cd790d8a9b5d4d4b89c2f19ec65491939fca932c156fa111d47401

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a65415e83cd790d8a9b5d4d4b89c2f19ec65491939fca932c156fa111d47401.msi
Size

4.0MB
MD5

e4375d55caf5b5a9866b40eaa0eac622
SHA1

af6b2527a004543059bc5f1a1a3e5b52b29d7367
SHA256

6a65415e83cd790d8a9b5d4d4b89c2f19ec65491939fca932c156fa111d47401
SHA512

52ba75139eab10ba6a9661757ea819e5e9d1609389c074ff606c7d401be1042099cdc06a8bd02ddab63a6143b24a3fee5cdb063d771334d0075bf7228dfd5ae1
SSDEEP

98304:Op8or/QxzNWNEBIBDMPbZdZBttLBxeWMlhCXcZLCujaOwPlbuVjr:ZmQJAN4IZIF1tttx2gXcZdaOkl4/

Score

10^/10

remcos backup_pip discovery persistence privilege_escalation rat

Malware Config

Extracted

Family

remcos

Botnet

BACKUP_PIP

heavytank21gh.com:4422

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
info.dat
keylog_flag
false
keylog_folder
tmpdata
mouse_option
false
mutex
aujifbh8123-1M56R1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2460	ICACLS.EXE
4980	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3288 set thread context of 3568	3288	DPMHelper.exe	106

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B5BE6D5D-742E-4140-823F-06F687B1238E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F7E.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSI9B09.tmp	msiexec.exe
File created	C:\Windows\Installer\e578ed2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e578ed2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B08.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4700	DPMHelper.exe
3288	DPMHelper.exe

Loads dropped DLL 17 IoCs

pid	Process
2024	MsiExec.exe
4700	DPMHelper.exe
4700	DPMHelper.exe
4700	DPMHelper.exe
4700	DPMHelper.exe
4700	DPMHelper.exe
4700	DPMHelper.exe
4700	DPMHelper.exe
4700	DPMHelper.exe
4700	DPMHelper.exe
3288	DPMHelper.exe
3288	DPMHelper.exe
3288	DPMHelper.exe
3288	DPMHelper.exe
3288	DPMHelper.exe
3288	DPMHelper.exe
2024	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5116	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DPMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DPMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9aa8484b1ca68e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9aa84840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9aa8484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9aa8484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9aa848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3396	msiexec.exe
3396	msiexec.exe
3288	DPMHelper.exe
3288	DPMHelper.exe
3568	cmd.exe
3568	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3288	DPMHelper.exe
3568	cmd.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5116	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5116	msiexec.exe
Token: SeSecurityPrivilege	3396	msiexec.exe
Token: SeCreateTokenPrivilege	5116	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5116	msiexec.exe
Token: SeLockMemoryPrivilege	5116	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5116	msiexec.exe
Token: SeMachineAccountPrivilege	5116	msiexec.exe
Token: SeTcbPrivilege	5116	msiexec.exe
Token: SeSecurityPrivilege	5116	msiexec.exe
Token: SeTakeOwnershipPrivilege	5116	msiexec.exe
Token: SeLoadDriverPrivilege	5116	msiexec.exe
Token: SeSystemProfilePrivilege	5116	msiexec.exe
Token: SeSystemtimePrivilege	5116	msiexec.exe
Token: SeProfSingleProcessPrivilege	5116	msiexec.exe
Token: SeIncBasePriorityPrivilege	5116	msiexec.exe
Token: SeCreatePagefilePrivilege	5116	msiexec.exe
Token: SeCreatePermanentPrivilege	5116	msiexec.exe
Token: SeBackupPrivilege	5116	msiexec.exe
Token: SeRestorePrivilege	5116	msiexec.exe
Token: SeShutdownPrivilege	5116	msiexec.exe
Token: SeDebugPrivilege	5116	msiexec.exe
Token: SeAuditPrivilege	5116	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5116	msiexec.exe
Token: SeChangeNotifyPrivilege	5116	msiexec.exe
Token: SeRemoteShutdownPrivilege	5116	msiexec.exe
Token: SeUndockPrivilege	5116	msiexec.exe
Token: SeSyncAgentPrivilege	5116	msiexec.exe
Token: SeEnableDelegationPrivilege	5116	msiexec.exe
Token: SeManageVolumePrivilege	5116	msiexec.exe
Token: SeImpersonatePrivilege	5116	msiexec.exe
Token: SeCreateGlobalPrivilege	5116	msiexec.exe
Token: SeBackupPrivilege	4536	vssvc.exe
Token: SeRestorePrivilege	4536	vssvc.exe
Token: SeAuditPrivilege	4536	vssvc.exe
Token: SeBackupPrivilege	3396	msiexec.exe
Token: SeRestorePrivilege	3396	msiexec.exe
Token: SeRestorePrivilege	3396	msiexec.exe
Token: SeTakeOwnershipPrivilege	3396	msiexec.exe
Token: SeRestorePrivilege	3396	msiexec.exe
Token: SeTakeOwnershipPrivilege	3396	msiexec.exe
Token: SeBackupPrivilege	1696	srtasks.exe
Token: SeRestorePrivilege	1696	srtasks.exe
Token: SeSecurityPrivilege	1696	srtasks.exe
Token: SeTakeOwnershipPrivilege	1696	srtasks.exe
Token: SeRestorePrivilege	3396	msiexec.exe
Token: SeTakeOwnershipPrivilege	3396	msiexec.exe
Token: SeRestorePrivilege	3396	msiexec.exe
Token: SeTakeOwnershipPrivilege	3396	msiexec.exe
Token: SeBackupPrivilege	1696	srtasks.exe
Token: SeRestorePrivilege	1696	srtasks.exe
Token: SeSecurityPrivilege	1696	srtasks.exe
Token: SeTakeOwnershipPrivilege	1696	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5116	msiexec.exe
5116	msiexec.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 1696	3396	msiexec.exe	89
PID 3396 wrote to memory of 1696	3396	msiexec.exe	89
PID 3396 wrote to memory of 2024	3396	msiexec.exe	92
PID 3396 wrote to memory of 2024	3396	msiexec.exe	92
PID 3396 wrote to memory of 2024	3396	msiexec.exe	92
PID 2024 wrote to memory of 2460	2024	MsiExec.exe	94
PID 2024 wrote to memory of 2460	2024	MsiExec.exe	94
PID 2024 wrote to memory of 2460	2024	MsiExec.exe	94
PID 2024 wrote to memory of 3496	2024	MsiExec.exe	96
PID 2024 wrote to memory of 3496	2024	MsiExec.exe	96
PID 2024 wrote to memory of 3496	2024	MsiExec.exe	96
PID 2024 wrote to memory of 3976	2024	MsiExec.exe	98
PID 2024 wrote to memory of 3976	2024	MsiExec.exe	98
PID 2024 wrote to memory of 3976	2024	MsiExec.exe	98
PID 3976 wrote to memory of 1076	3976	cmd.exe	100
PID 3976 wrote to memory of 1076	3976	cmd.exe	100
PID 3976 wrote to memory of 1076	3976	cmd.exe	100
PID 1076 wrote to memory of 3048	1076	cmd.exe	101
PID 1076 wrote to memory of 3048	1076	cmd.exe	101
PID 1076 wrote to memory of 3048	1076	cmd.exe	101
PID 3976 wrote to memory of 4700	3976	cmd.exe	102
PID 3976 wrote to memory of 4700	3976	cmd.exe	102
PID 3976 wrote to memory of 4700	3976	cmd.exe	102
PID 2024 wrote to memory of 4980	2024	MsiExec.exe	103
PID 2024 wrote to memory of 4980	2024	MsiExec.exe	103
PID 2024 wrote to memory of 4980	2024	MsiExec.exe	103
PID 4700 wrote to memory of 3288	4700	DPMHelper.exe	105
PID 4700 wrote to memory of 3288	4700	DPMHelper.exe	105
PID 4700 wrote to memory of 3288	4700	DPMHelper.exe	105
PID 3288 wrote to memory of 3568	3288	DPMHelper.exe	106
PID 3288 wrote to memory of 3568	3288	DPMHelper.exe	106
PID 3288 wrote to memory of 3568	3288	DPMHelper.exe	106
PID 3288 wrote to memory of 3568	3288	DPMHelper.exe	106
PID 3568 wrote to memory of 2960	3568	cmd.exe	114
PID 3568 wrote to memory of 2960	3568	cmd.exe	114
PID 3568 wrote to memory of 2960	3568	cmd.exe	114
PID 3568 wrote to memory of 2960	3568	cmd.exe	114
PID 3568 wrote to memory of 2960	3568	cmd.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6a65415e83cd790d8a9b5d4d4b89c2f19ec65491939fca932c156fa111d47401.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5116

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D8AABE44A92814A8C5AE5262FB56C7BD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2460
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\files\basics.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c xcopy /s "C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\files" /d C:\Users\Admin\AppData\Roaming\microsoft
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /s "C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\files" /d C:\Users\Admin\AppData\Roaming\microsoft
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:3048
  - - C:\Users\Admin\AppData\Roaming\Microsoft\DPMHelper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\DPMHelper.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\Users\Admin\AppData\Local\streamService_beta\DPMHelper.exe
        
        C:\Users\Admin\AppData\Local\streamService_beta\DPMHelper.exe
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3288
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4980

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\tmpdata\info.dat

Filesize
144B

MD5
05bd1336e768e3371bc022f6d646c7d8

SHA1
2e9339221211347691f8b79b41ca31b7bdd8c677

SHA256
1ecb4f2f76367703a542d917bab6eb32083c6f77e87cc94c00b26ee6d107dc97

SHA512
cffe60e318e99c8dee1c0ce314932f07a79594fe68116e64a9fe526b685c14515d5b76b9b397ad612f00c51cd502e107ec27442cbfd93ab64d60c656cb014960

Download Submit
C:\Users\Admin\AppData\Local\Temp\1bbbc606

Filesize
1.2MB

MD5
d8b63cc4d7d9ea942bdf540279610c76

SHA1
e09ec5332809eabcd2b3c06def7c35403fdbe665

SHA256
3010b91d1c82f6f4d34b9dfd1ebd73c6dadaace161d11cb9a316e45a0a102654

SHA512
a1be170add00188bdcf97ee5156a991396b9526a4591070754611b7484f39f8febb5ac677832f0dc545590ae4f4dac5334b72b14642d0197f9e405e43a6ab90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\files.cab

Filesize
3.7MB

MD5
afe47e7c9e3846b69303fce54d9c08fc

SHA1
fff4819cd283c4413ebab21310369e7285af2870

SHA256
9bc9688887112bc048f4dd95a34174dbd11adb717dfb1ae40891c3459404d3e3

SHA512
38a19e625c7914bdd127ba6c3b14f0a77d10763c18d135fe5fe7e056f0dab137cd124d94e18fd765dd01982df4fba28de5b594f068e7edf708ab0c0a3746e2e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\files\basics.cmd

Filesize
103B

MD5
84a7194e4cc9413ed0dbf64107c5f7b0

SHA1
30e608bcd3e4922a3024cde661c8cbce16ff442f

SHA256
5baf90c1464d136af6dd81963cecf5bc1e489d0a2ff3b9831f4c36a937e4358c

SHA512
00d3630577338d949d49189d527d55828bcdf47933a6600d01daef3434eb5d59fa113db6dc25abfc18467db970e3f09add6dcbe43e98651df6d09e9f345d1282

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\files\cmdfmt.exe

Filesize
2.0MB

MD5
3c06138c0e9b9706281dea5b5037bfbb

SHA1
608a2ee6adf4c3ccfb3ea25edf393f5745cb7b57

SHA256
82f93f71f45c1d2ea20697d01d3f5ae50761942a956384e217ba898efa63ec47

SHA512
bf1f360f99f0f38ef66d97d42ba689936b22c38e092533e14723974ab2f2b9ffac61446400f3379f97c7edd982c6cec62400670682855ef5482d3bcf6c567131

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\files\rtl120.bpl

Filesize
1.1MB

MD5
1681f93e11a7ed23612a55bcef7f1023

SHA1
9b378bbdb287ebd7596944bce36b6156caa9ff7d

SHA256
7ed5369fcf0283ea18974c43dbff80e6006b155b76da7c72fa9619eb03f54cef

SHA512
726e8f58648a6abaf1f2d5bebcf28c1d8320551a3b6e7eef0cf8d99f9ef941e30e7004c24c98e9b5e931a86128d26de7decba202390665a005e972dcbe87ab93

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\msiwrapper.ini

Filesize
428B

MD5
0091161150b7ce75b6a95b85c9e51350

SHA1
a1c545dc8788a53e58d6ff5f5b093ed5a5d79dd1

SHA256
f7074be9895ae862c19e91eca37f73b49657607d0be2d28f411d4ef350a2bdc5

SHA512
32081f19e14279723fa12f78482040bac77e7776f4c4346ba71c769715f0e7b9e520e519f137e0fa6e8e1fe5cf454dcd1183683cc2d8cefab2c594af64feb990

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\msiwrapper.ini

Filesize
1KB

MD5
db878963c79a0affb405b88f58a433a7

SHA1
6524d17826151a6f7ab059b9275ceda250725ec7

SHA256
24aae53cb7f926424cf6d4303cc41b4488415fd3dfc086c899a026bf56a1b9a3

SHA512
2decf26c8141028510453c875dce0c4be1959a55b60cfdc16552e86ff076a709c80a22399872c2548ecd1f110f7eae8569c0b33a62119ffa586102b6f40af104

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\msiwrapper.ini

Filesize
1KB

MD5
a83e75eb5e48f3d015fed40cac24382e

SHA1
1421607ab8a3c5422c60867adb167e5212ea2d52

SHA256
2c937ac3261fce0d886d92a74bcd4f57ec1008ff8213cfe50f8369a0407098b1

SHA512
816ed781d3c8e494bbed20b1f230beb2e54e8e83bde0120a02693417747c24b3a759138af1995c596fe1705c52a8a5c2d1201ae84478316f22cedfdf7fa06444

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-774ff447-c01e-4866-9c80-90f00e5bd898\msiwrapper.ini

Filesize
1KB

MD5
106da96c1b5514260f8c1df19bb33858

SHA1
3c6bdd173ec180c1dd3723ba3452232525eb08e5

SHA256
05fbccb9738c4c356a4562d61ff36d119a96f6ea39925f17c8fb09dd7fc554c3

SHA512
c2d1cb594df674fbb71fa995ce85e2db63a4c683c6586ff69c77ddce74e714380d178d163c10788f490fb7cb5cb585e54f1e88726d819c9d5fb1efdef1de4deb

Download Submit
C:\Users\Admin\AppData\Local\streamService_beta\madbasic_.bpl

Filesize
210KB

MD5
e03a0056e75d3a5707ba199bc2ea701f

SHA1
bf40ab316e65eb17a58e70a3f0ca8426f44f5bef

SHA256
7826395127e791a883359ea81308174700da0af8052cc9853b19fd29c2e4badb

SHA512
b0a3cfb6b34832f048fe0fc70c6fa76ae16a2cacda930f6529a83a967d6e8de1c69b93e0de3dc2126c5385d85e814687e695a0a4131399a69633141cad98da2a

Download Submit
C:\Users\Admin\AppData\Local\streamService_beta\vcl120.bpl

Filesize
1.9MB

MD5
13a2734bb2249010514386ebc856b8da

SHA1
8f6e3b30f30a5bba9bc6baaf8f440e085a6a568a

SHA256
713c21d009000d504d9bcf3ce95d50e74d3933083783de144db0a16e2425ebcc

SHA512
2f108436fc1a03591802ff6b8c6ac1de1c0388b2a2a6f8839c10b5f0ec06b66775f261da4ace05fa367eb46b5be533949c092e113fe1270adedb9cb8c34ba2dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\DPMHelper.exe

Filesize
2.3MB

MD5
5d52ef45b6e5bf144307a84c2af1581b

SHA1
414a899ec327d4a9daa53983544245b209f25142

SHA256
26a24d3b0206c6808615c7049859c2fe62c4dcd87e7858be40ae8112b0482616

SHA512
458f47c1e4ccf41edaacc57abb663ee77ca098fffc596fad941bbdea67653aeabc79b34d607078b9ee5adb45614e26f5c28a09e8faf9532081fdd5dec9ac3c48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\madDisAsm_.bpl

Filesize
63KB

MD5
d80c131cfac41ebffcb37141a81bb8a5

SHA1
b7e9e91a1bf6ea800803d4c867978e2f053a53ee

SHA256
d417b480d60126d193007db9a017755014d41643d0c00d121674a993ece8cc39

SHA512
9946e71e465ac5c750447fb90be695463547ea2e44bdb060433bc5ef74f306883282adb9141139fbfb4b8079f959f650622cecd890fc9403455c8a6547228895

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\madexcept_.bpl

Filesize
436KB

MD5
98e59596edd9b888d906c5409e515803

SHA1
b79d73967a2df21d00740bc77ccebda061b44ab6

SHA256
a6ca13af74a64e4ab5ebb2d12b757cecf1a683cb9cd0ae7906db1b4b2c8a90c0

SHA512
ba617227849d2eb3285395e2d1babfe01902be143144be895011f0389f1860d0d7f08c6bbc4d461384eba270f866cce3351f52af1dc9ef9719c677619de79e42

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\nanometre.bmp

Filesize
944KB

MD5
5f111e4eb86d25ba882bba36ac24bfab

SHA1
6fd27994a0e0d1f689699ee4c47044084cc2ba64

SHA256
1d85daa12a96bf69947394e184ae2619355819d2a53bdf480cb1d0549d9c58b9

SHA512
ab1b15e963f6d7bfa9768292727f90750d0e9b06ae8f5faa09b272f8990262ce5bc916322a84b367a53648c2c21f53d9fbbfa9c503327812707fcd78da8f7e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\vclx120.bpl

Filesize
222KB

MD5
3cb8f7606940c9b51c45ebaeb84af728

SHA1
7f33a8b5f8f7210bd93b330c5e27a1e70b22f57b

SHA256
2feec33d1e3f3d69c717f4528b8f7f5c030caae6fb37c2100cb0b5341367d053

SHA512
7559cdf6c8dbea052242f3b8129979f7d2d283f84040f1d68ae10438548072715a56a5af88b8562aeea7143194e7c5bddac3fdb01ded411a0b1cac9f0c6eef3f

Download Submit
C:\Windows\Installer\MSI8F7E.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
6808e35f810ae578e9148c359468f00a

SHA1
34f4f309846fb3672cb69fc57151957ea5e8a8f6

SHA256
0e3dfb4fe522dafa197ff4b5561d86be7f5703b3cbd81e678941c198c0fc451d

SHA512
6a2e8e887059c9524f1fd7c3b5aab80851c39d1248f8c0f6d0b7fd411f67bb4edc257b1a4a8439a7736b080570be7e45d14731c397f5c473318ee9a194d39ab1

Download Submit
\??\Volume{8484aac9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b19fbb41-16b1-41f3-baf5-ace75ca62905}_OnDiskSnapshotProp

Filesize
6KB

MD5
a2018f6f8a442179f333530f8cc68c0e

SHA1
812b7bb49f9467ca07b2584b9dee8e54e74c9668

SHA256
198ce2b12eb1b9e5e91d2cb7bea9e62c48bba94eb3ce7b2d94b3f51ed70443f7

SHA512
759498fe11c7398bb9f700291d7da89cdc984386df6aace6299af65259e31fd0ba64bde7ffd9ddf8c7478c0e555d408742c01f2dbd9ff471105caec73f4f9c7d

Download Submit
memory/2960-212-0x00007FFCCF310000-0x00007FFCCF505000-memory.dmp

Filesize
2.0MB

Download
memory/2960-230-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-245-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-242-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-213-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-239-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-221-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-236-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-233-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-224-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-227-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-215-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3288-202-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/3288-205-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/3288-201-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/3288-198-0x0000000072E60000-0x0000000072FDB000-memory.dmp

Filesize
1.5MB

Download
memory/3288-180-0x0000000072E60000-0x0000000072FDB000-memory.dmp

Filesize
1.5MB

Download
memory/3288-183-0x00007FFCCF310000-0x00007FFCCF505000-memory.dmp

Filesize
2.0MB

Download
memory/3568-210-0x0000000072E60000-0x0000000072FDB000-memory.dmp

Filesize
1.5MB

Download
memory/3568-208-0x00007FFCCF310000-0x00007FFCCF505000-memory.dmp

Filesize
2.0MB

Download
memory/4700-181-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/4700-186-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/4700-154-0x0000000072E60000-0x0000000072FDB000-memory.dmp

Filesize
1.5MB

Download
memory/4700-188-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/4700-155-0x00007FFCCF310000-0x00007FFCCF505000-memory.dmp

Filesize
2.0MB

Download
memory/4700-187-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/4700-182-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/4700-184-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/4700-185-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download