remcos | d30e71d321786a1cda09b0c75d408a8541b6167b6753de08f46504d90d2af129

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d30e71d321786a1cda09b0c75d408a8541b6167b6753de08f46504d90d2af129.msi
Size

4.0MB
MD5

bce2b57d15105b59a838eb1bd12aa7ee
SHA1

81d4e952363ec181cd06007fbbd5a8b83cce51cf
SHA256

d30e71d321786a1cda09b0c75d408a8541b6167b6753de08f46504d90d2af129
SHA512

4fd8dee6ca059a1174ceed13d86843c03150424ff06305e5d35fac0e3a66a28e477fe19a138c2526ad87ccadb9251d68ebbf6d024e053959dee698a8140b499a
SSDEEP

98304:xptfJOkKJqbdkE3GCIA/DCSlT/IZY//xEYQvjGkvUco5B1:151xkE3G8XIKB27dMco5

Score

10^/10

remcos backup_pip discovery persistence privilege_escalation rat

Malware Config

Extracted

Family

remcos

Botnet

BACKUP_PIP

heavytank21gh.com:4422

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
info.dat
keylog_flag
false
keylog_folder
tmpdata
mouse_option
false
mutex
aujifbh8123-1M56R1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4788	ICACLS.EXE
212	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4580 set thread context of 2228	4580	DPMHelper.exe	104

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF790.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ef23.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ef23.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFBF.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\Installer\SourceHash{D3424035-1270-4BCF-AFA2-AA285A2A10F0}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSIF7A0.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4004	DPMHelper.exe
4580	DPMHelper.exe

Loads dropped DLL 20 IoCs

pid	Process
2860	MsiExec.exe
4004	DPMHelper.exe
4004	DPMHelper.exe
4004	DPMHelper.exe
4004	DPMHelper.exe
4004	DPMHelper.exe
4004	DPMHelper.exe
4004	DPMHelper.exe
4004	DPMHelper.exe
4004	DPMHelper.exe
4004	DPMHelper.exe
4580	DPMHelper.exe
4580	DPMHelper.exe
4580	DPMHelper.exe
4580	DPMHelper.exe
4580	DPMHelper.exe
4580	DPMHelper.exe
4580	DPMHelper.exe
4580	DPMHelper.exe
2860	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2312	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DPMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DPMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a2808484d8f468e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a28084840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a2808484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da2808484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a280848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1584	msiexec.exe
1584	msiexec.exe
4580	DPMHelper.exe
2228	cmd.exe
2228	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4580	DPMHelper.exe
2228	cmd.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2312	msiexec.exe
Token: SeSecurityPrivilege	1584	msiexec.exe
Token: SeCreateTokenPrivilege	2312	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2312	msiexec.exe
Token: SeLockMemoryPrivilege	2312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2312	msiexec.exe
Token: SeMachineAccountPrivilege	2312	msiexec.exe
Token: SeTcbPrivilege	2312	msiexec.exe
Token: SeSecurityPrivilege	2312	msiexec.exe
Token: SeTakeOwnershipPrivilege	2312	msiexec.exe
Token: SeLoadDriverPrivilege	2312	msiexec.exe
Token: SeSystemProfilePrivilege	2312	msiexec.exe
Token: SeSystemtimePrivilege	2312	msiexec.exe
Token: SeProfSingleProcessPrivilege	2312	msiexec.exe
Token: SeIncBasePriorityPrivilege	2312	msiexec.exe
Token: SeCreatePagefilePrivilege	2312	msiexec.exe
Token: SeCreatePermanentPrivilege	2312	msiexec.exe
Token: SeBackupPrivilege	2312	msiexec.exe
Token: SeRestorePrivilege	2312	msiexec.exe
Token: SeShutdownPrivilege	2312	msiexec.exe
Token: SeDebugPrivilege	2312	msiexec.exe
Token: SeAuditPrivilege	2312	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2312	msiexec.exe
Token: SeChangeNotifyPrivilege	2312	msiexec.exe
Token: SeRemoteShutdownPrivilege	2312	msiexec.exe
Token: SeUndockPrivilege	2312	msiexec.exe
Token: SeSyncAgentPrivilege	2312	msiexec.exe
Token: SeEnableDelegationPrivilege	2312	msiexec.exe
Token: SeManageVolumePrivilege	2312	msiexec.exe
Token: SeImpersonatePrivilege	2312	msiexec.exe
Token: SeCreateGlobalPrivilege	2312	msiexec.exe
Token: SeBackupPrivilege	2688	vssvc.exe
Token: SeRestorePrivilege	2688	vssvc.exe
Token: SeAuditPrivilege	2688	vssvc.exe
Token: SeBackupPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeRestorePrivilege	1584	msiexec.exe
Token: SeTakeOwnershipPrivilege	1584	msiexec.exe
Token: SeBackupPrivilege	3192	srtasks.exe
Token: SeRestorePrivilege	3192	srtasks.exe
Token: SeSecurityPrivilege	3192	srtasks.exe
Token: SeTakeOwnershipPrivilege	3192	srtasks.exe
Token: SeBackupPrivilege	3192	srtasks.exe
Token: SeRestorePrivilege	3192	srtasks.exe
Token: SeSecurityPrivilege	3192	srtasks.exe
Token: SeTakeOwnershipPrivilege	3192	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2312	msiexec.exe
2312	msiexec.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3192	1584	msiexec.exe	89
PID 1584 wrote to memory of 3192	1584	msiexec.exe	89
PID 1584 wrote to memory of 2860	1584	msiexec.exe	91
PID 1584 wrote to memory of 2860	1584	msiexec.exe	91
PID 1584 wrote to memory of 2860	1584	msiexec.exe	91
PID 2860 wrote to memory of 4788	2860	MsiExec.exe	92
PID 2860 wrote to memory of 4788	2860	MsiExec.exe	92
PID 2860 wrote to memory of 4788	2860	MsiExec.exe	92
PID 2860 wrote to memory of 4724	2860	MsiExec.exe	94
PID 2860 wrote to memory of 4724	2860	MsiExec.exe	94
PID 2860 wrote to memory of 4724	2860	MsiExec.exe	94
PID 2860 wrote to memory of 4516	2860	MsiExec.exe	96
PID 2860 wrote to memory of 4516	2860	MsiExec.exe	96
PID 2860 wrote to memory of 4516	2860	MsiExec.exe	96
PID 4516 wrote to memory of 1076	4516	cmd.exe	98
PID 4516 wrote to memory of 1076	4516	cmd.exe	98
PID 4516 wrote to memory of 1076	4516	cmd.exe	98
PID 1076 wrote to memory of 2284	1076	cmd.exe	99
PID 1076 wrote to memory of 2284	1076	cmd.exe	99
PID 1076 wrote to memory of 2284	1076	cmd.exe	99
PID 4516 wrote to memory of 4004	4516	cmd.exe	100
PID 4516 wrote to memory of 4004	4516	cmd.exe	100
PID 4516 wrote to memory of 4004	4516	cmd.exe	100
PID 2860 wrote to memory of 212	2860	MsiExec.exe	101
PID 2860 wrote to memory of 212	2860	MsiExec.exe	101
PID 2860 wrote to memory of 212	2860	MsiExec.exe	101
PID 4004 wrote to memory of 4580	4004	DPMHelper.exe	103
PID 4004 wrote to memory of 4580	4004	DPMHelper.exe	103
PID 4004 wrote to memory of 4580	4004	DPMHelper.exe	103
PID 4580 wrote to memory of 2228	4580	DPMHelper.exe	104
PID 4580 wrote to memory of 2228	4580	DPMHelper.exe	104
PID 4580 wrote to memory of 2228	4580	DPMHelper.exe	104
PID 4580 wrote to memory of 2228	4580	DPMHelper.exe	104
PID 2228 wrote to memory of 3768	2228	cmd.exe	116
PID 2228 wrote to memory of 3768	2228	cmd.exe	116
PID 2228 wrote to memory of 3768	2228	cmd.exe	116
PID 2228 wrote to memory of 3768	2228	cmd.exe	116
PID 2228 wrote to memory of 3768	2228	cmd.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d30e71d321786a1cda09b0c75d408a8541b6167b6753de08f46504d90d2af129.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2312

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3192
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2AB23B5F5EDE13117B8C463CD6410714
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4788
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\files\nanotest.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c xcopy /s "C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\files" /d C:\Users\Admin\AppData\Roaming\microsoft
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /s "C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\files" /d C:\Users\Admin\AppData\Roaming\microsoft
        5⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:2284
  - - C:\Users\Admin\AppData\Roaming\Microsoft\DPMHelper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\DPMHelper.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4004
    - - C:\Users\Admin\AppData\Local\streamService_beta\DPMHelper.exe
        
        C:\Users\Admin\AppData\Local\streamService_beta\DPMHelper.exe
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4580
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\tmpdata\info.dat

Filesize
144B

MD5
54c2bfa8bdf89ebeddf2b1ddca808172

SHA1
7d09bc10aeca4c1a4027de926199737c7cca4490

SHA256
49017e852310ef4f304a39db9441c5dd54c0fa8855dee26998f84ddeafa5de10

SHA512
0966c8c89c8c7bacc541cc5b3d502591f97223bfa8ce4d48f9554102a7f496d82a8ed4c78b31f6eaf914d7087a743d63532969cebac8a411157e629ddf1d90ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\files.cab

Filesize
3.7MB

MD5
83b29af52461010cb3d6a6811e89e026

SHA1
9d10b6ed4659efe649f2b45f38dc70f69d957b7e

SHA256
61220ae6f6d018a70d869778516fcf1248ca94ad1f4bd39d0f449d6602af7102

SHA512
eac713d455e43ef882e7953395576f121cbac10d28ab7a29b3c9b2fb1a5fb3bbdeac2b15d20378e713f9125bd4ddaa82c94b7450112c45bd2a8623c76bacd452

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\files\DPMHelper.exe

Filesize
2.3MB

MD5
5d52ef45b6e5bf144307a84c2af1581b

SHA1
414a899ec327d4a9daa53983544245b209f25142

SHA256
26a24d3b0206c6808615c7049859c2fe62c4dcd87e7858be40ae8112b0482616

SHA512
458f47c1e4ccf41edaacc57abb663ee77ca098fffc596fad941bbdea67653aeabc79b34d607078b9ee5adb45614e26f5c28a09e8faf9532081fdd5dec9ac3c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\files\cmdfmt.exe

Filesize
2.0MB

MD5
3c06138c0e9b9706281dea5b5037bfbb

SHA1
608a2ee6adf4c3ccfb3ea25edf393f5745cb7b57

SHA256
82f93f71f45c1d2ea20697d01d3f5ae50761942a956384e217ba898efa63ec47

SHA512
bf1f360f99f0f38ef66d97d42ba689936b22c38e092533e14723974ab2f2b9ffac61446400f3379f97c7edd982c6cec62400670682855ef5482d3bcf6c567131

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\files\madbasic_.bpl

Filesize
210KB

MD5
e03a0056e75d3a5707ba199bc2ea701f

SHA1
bf40ab316e65eb17a58e70a3f0ca8426f44f5bef

SHA256
7826395127e791a883359ea81308174700da0af8052cc9853b19fd29c2e4badb

SHA512
b0a3cfb6b34832f048fe0fc70c6fa76ae16a2cacda930f6529a83a967d6e8de1c69b93e0de3dc2126c5385d85e814687e695a0a4131399a69633141cad98da2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\files\nanotest.cmd

Filesize
86B

MD5
962bc48cda9489b1b9ae319468baf757

SHA1
26e5eec731f53ca5ad6b784f9a7d64c486c7d0af

SHA256
fa106a788f6d31e8ab65b581f80846e5ff4e0ce855fc9399531c9bdfd0a6c671

SHA512
dd5012633bfaa64526efdc01d9165a733bbbecf3cc4bd85a9329dfcdaa066fb4e5692c20ff9f591d3fe57fda70fa086e8fdad9312d1d0ec948ddff59a5895544

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\msiwrapper.ini

Filesize
1KB

MD5
f5978b30cdb6d99c0f8d02f3dc3b89f4

SHA1
e6680bf00013706e5a2fb4b8ec1fc28cac9a1510

SHA256
b242811291ff8cc87360ac0187627dc833285b2ba28b88cd11e9fa3ccafe3203

SHA512
1702a9596f4a2dbe3c4176c3c186cc6128623f7a4752922e72fce8e128db0ceaabffde7aaf693620a72088b27dcb6ec4ce8a11455d7f0c692cdbdae5dd43473e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\msiwrapper.ini

Filesize
420B

MD5
8acb3d299cbe3fd64621b32198f0684d

SHA1
38ab7a3d60e0f15dd8c95fc9684a5ca0f5ded852

SHA256
dfe7d661f2f30881795d57c58378340411775e4bd01230dbb6f6c105cd0a6684

SHA512
bf680a46cb486eecd46f8a931e62f409eb32a3e9ea3abc36f800e12b0dbe604f7f10e0b9e244d9a3a8193e95153a9be2c3fb874e2de11f621d9acf93d09ae703

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\msiwrapper.ini

Filesize
1KB

MD5
8d5b618c1a9e6fef3a2fb84f6218f774

SHA1
12ede75973e945cb4c8d352b7a40c798ca89b511

SHA256
2059c8426af86367f1658971847576b10ec3965777ad6af29624b1b3037e501c

SHA512
5097a0487b3992829381d1ecfefac3584c3a4eefdc26e0bbc467248b51c78e25758592e926c215c98d2a654964221d51dbbf24fd2e24da1a4b763a1a524b22f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-76234be1-20c7-4b3a-84fe-1f8141109c6f\msiwrapper.ini

Filesize
1KB

MD5
223d5cd0a78e5c388793f5a6e0e42fe9

SHA1
51887e51ba6351adf4d20da0cf28be9f5811943d

SHA256
e4ad99ff74169025e64e1d2d50f4c9a384b0c3b3cac44d36d5c67e54fb9533bf

SHA512
c445dfbcaf93730c6df3190a2e0befe5b2b5a731940092ad1adf7aa0c408c10e2715030076581461e49834b004b44ae5609a3d3fb53da676bf359234e7779aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa5a46dd

Filesize
1.2MB

MD5
0a93843f124ca05e734ba8ca10c33b08

SHA1
95bb04ec579e12c0cc04af2ffcfd72c38dadf5c5

SHA256
5b3c2e5eaa057990f12420b9da45bceae064171c5ad5754c5cf99cc339c83921

SHA512
635e77a79a3d8a0c303de0ca30711baba4cc5a67d14d18d00df7739282ac9136f254ae7008cbde7f4dc558d9c6f752bef9a96659b1b7f020dbee09a82ec12c96

Download Submit
C:\Users\Admin\AppData\Local\streamService_beta\madexcept_.bpl

Filesize
436KB

MD5
98e59596edd9b888d906c5409e515803

SHA1
b79d73967a2df21d00740bc77ccebda061b44ab6

SHA256
a6ca13af74a64e4ab5ebb2d12b757cecf1a683cb9cd0ae7906db1b4b2c8a90c0

SHA512
ba617227849d2eb3285395e2d1babfe01902be143144be895011f0389f1860d0d7f08c6bbc4d461384eba270f866cce3351f52af1dc9ef9719c677619de79e42

Download Submit
C:\Users\Admin\AppData\Local\streamService_beta\rtl120.bpl

Filesize
1.1MB

MD5
1681f93e11a7ed23612a55bcef7f1023

SHA1
9b378bbdb287ebd7596944bce36b6156caa9ff7d

SHA256
7ed5369fcf0283ea18974c43dbff80e6006b155b76da7c72fa9619eb03f54cef

SHA512
726e8f58648a6abaf1f2d5bebcf28c1d8320551a3b6e7eef0cf8d99f9ef941e30e7004c24c98e9b5e931a86128d26de7decba202390665a005e972dcbe87ab93

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\maddisAsm_.bpl

Filesize
63KB

MD5
d80c131cfac41ebffcb37141a81bb8a5

SHA1
b7e9e91a1bf6ea800803d4c867978e2f053a53ee

SHA256
d417b480d60126d193007db9a017755014d41643d0c00d121674a993ece8cc39

SHA512
9946e71e465ac5c750447fb90be695463547ea2e44bdb060433bc5ef74f306883282adb9141139fbfb4b8079f959f650622cecd890fc9403455c8a6547228895

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\nanometre.bmp

Filesize
944KB

MD5
5f111e4eb86d25ba882bba36ac24bfab

SHA1
6fd27994a0e0d1f689699ee4c47044084cc2ba64

SHA256
1d85daa12a96bf69947394e184ae2619355819d2a53bdf480cb1d0549d9c58b9

SHA512
ab1b15e963f6d7bfa9768292727f90750d0e9b06ae8f5faa09b272f8990262ce5bc916322a84b367a53648c2c21f53d9fbbfa9c503327812707fcd78da8f7e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\vcl120.bpl

Filesize
1.9MB

MD5
13a2734bb2249010514386ebc856b8da

SHA1
8f6e3b30f30a5bba9bc6baaf8f440e085a6a568a

SHA256
713c21d009000d504d9bcf3ce95d50e74d3933083783de144db0a16e2425ebcc

SHA512
2f108436fc1a03591802ff6b8c6ac1de1c0388b2a2a6f8839c10b5f0ec06b66775f261da4ace05fa367eb46b5be533949c092e113fe1270adedb9cb8c34ba2dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\vclx120.bpl

Filesize
222KB

MD5
3cb8f7606940c9b51c45ebaeb84af728

SHA1
7f33a8b5f8f7210bd93b330c5e27a1e70b22f57b

SHA256
2feec33d1e3f3d69c717f4528b8f7f5c030caae6fb37c2100cb0b5341367d053

SHA512
7559cdf6c8dbea052242f3b8129979f7d2d283f84040f1d68ae10438548072715a56a5af88b8562aeea7143194e7c5bddac3fdb01ded411a0b1cac9f0c6eef3f

Download Submit
C:\Windows\Installer\MSIEFBF.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
c9acecd4974515a92a5e3d225cca1aaa

SHA1
645fb8e81f1884c728e8eedcb3c05e1302a3e71b

SHA256
a9bc69ef1a633a457ba0d2cb52981d9077b3e880170be7dcaebed06be3767db4

SHA512
c7d70d3cb97f3211d0fc3859a86e24c8767a208229ec393c048b653641bc2b3ede4c3fb25eb59c7bb03a5cb17afa955525dd2e114e80e60182abcc4d239d7c77

Download Submit
\??\Volume{848480a2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{30469128-3b51-497b-9a63-343ed35ea90f}_OnDiskSnapshotProp

Filesize
6KB

MD5
e29263cdf392de43deee6ae4193c0164

SHA1
e5e7474fa233be7b5f0cb1e108b9e8e5c387921b

SHA256
16ff66352fb26c3c27cbb92e64956fbf5109584233e93a04afd04a1e5c220384

SHA512
0a22201a028730fbc1895ca0e0bc9f5165aad3eee69ade9adbf51e4cc6f6c30503266cac632ec3872c29d9dff17834b13c8b2ef357a83a7f715038ea47415330

Download Submit
memory/2228-211-0x00007FFD66F50000-0x00007FFD67145000-memory.dmp

Filesize
2.0MB

Download
memory/2228-213-0x00000000732F0000-0x000000007346B000-memory.dmp

Filesize
1.5MB

Download
memory/3768-227-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3768-230-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3768-224-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3768-233-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3768-221-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3768-216-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3768-215-0x00007FFD66F50000-0x00007FFD67145000-memory.dmp

Filesize
2.0MB

Download
memory/3768-236-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3768-239-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3768-242-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3768-245-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4004-171-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/4004-177-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/4004-188-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/4004-181-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/4004-180-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/4004-154-0x00007FFD66F50000-0x00007FFD67145000-memory.dmp

Filesize
2.0MB

Download
memory/4004-153-0x00000000732F0000-0x000000007346B000-memory.dmp

Filesize
1.5MB

Download
memory/4004-179-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/4004-178-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/4580-199-0x00000000732F0000-0x000000007346B000-memory.dmp

Filesize
1.5MB

Download
memory/4580-189-0x00000000732F0000-0x000000007346B000-memory.dmp

Filesize
1.5MB

Download
memory/4580-190-0x00007FFD66F50000-0x00007FFD67145000-memory.dmp

Filesize
2.0MB

Download
memory/4580-202-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/4580-204-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/4580-206-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download