Analysis
-
max time kernel
179s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 19:26
Static task
static1
Behavioral task
behavioral1
Sample
41589419116464448286035679864158972845276735013687.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
41589419116464448286035679864158972845276735013687.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
41589419116464448286035679864158972845276735013687.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
41589419116464448286035679864158972845276735013687.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
41589419116464448286035679864158972845276735013687.exe
Resource
win7-20240729-en
General
-
Target
41589419116464448286035679864158972845276735013687.exe
-
Size
2.7MB
-
MD5
b00ececc12e8dedbe256613f1b945b23
-
SHA1
97cb8249006a80e0773bb3aaba631171715ffcd4
-
SHA256
87768a35d6a9b73f30d4d4adcd96b8c4cca695dec762fe7962859972fbd75e56
-
SHA512
afd4ea1986da088c3f4c2757baeb4b21b14bd4b5e22e00260eca7e719c8fc78d803443b9dfc457799ab7b2d7d306395fbd48bf9d1bde260106a7ad3038c93d97
-
SSDEEP
49152:9wREDDM04bCaLjmFy1nOFPG/3E1/4BtkMgHeXDREnz+d:9wREsbCaLaeO2EJSkTs0+d
Malware Config
Extracted
remcos
DropBoxF
cubalibreu6obyau6j8.duckdns.org:2020
-
audio_path
%UserProfile%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
flof
-
keylog_flag
false
-
keylog_folder
tlof
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
fMXJEdWdidHdX-6WDMJ4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Executes dropped EXE 2 IoCs
pid Process 1960 41589419116464448286035679864158972845276735013687.tmp 2432 41589419116464448286035679864158972845276735013687.tmp -
Loads dropped DLL 3 IoCs
pid Process 2984 regsvr32.exe 1212 regsvr32.exe 2760 regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to execute payload.
pid Process 4524 powershell.exe 4844 powershell.exe 3456 powershell.exe 4656 powershell.exe 4524 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41589419116464448286035679864158972845276735013687.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41589419116464448286035679864158972845276735013687.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41589419116464448286035679864158972845276735013687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41589419116464448286035679864158972845276735013687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4296 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2432 41589419116464448286035679864158972845276735013687.tmp 2432 41589419116464448286035679864158972845276735013687.tmp 2984 regsvr32.exe 2984 regsvr32.exe 2984 regsvr32.exe 2984 regsvr32.exe 2984 regsvr32.exe 2984 regsvr32.exe 4656 powershell.exe 4656 powershell.exe 4524 powershell.exe 4524 powershell.exe 2984 regsvr32.exe 2984 regsvr32.exe 2984 regsvr32.exe 2984 regsvr32.exe 2984 regsvr32.exe 2984 regsvr32.exe 2984 regsvr32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 1212 regsvr32.exe 1212 regsvr32.exe 1212 regsvr32.exe 1212 regsvr32.exe 1212 regsvr32.exe 1212 regsvr32.exe 4844 powershell.exe 4844 powershell.exe 4844 powershell.exe 1212 regsvr32.exe 1212 regsvr32.exe 1212 regsvr32.exe 1212 regsvr32.exe 1212 regsvr32.exe 1212 regsvr32.exe 2760 regsvr32.exe 2760 regsvr32.exe 2760 regsvr32.exe 2760 regsvr32.exe 2760 regsvr32.exe 2760 regsvr32.exe 3456 powershell.exe 3456 powershell.exe 2760 regsvr32.exe 2760 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4656 powershell.exe Token: SeIncreaseQuotaPrivilege 4656 powershell.exe Token: SeSecurityPrivilege 4656 powershell.exe Token: SeTakeOwnershipPrivilege 4656 powershell.exe Token: SeLoadDriverPrivilege 4656 powershell.exe Token: SeSystemProfilePrivilege 4656 powershell.exe Token: SeSystemtimePrivilege 4656 powershell.exe Token: SeProfSingleProcessPrivilege 4656 powershell.exe Token: SeIncBasePriorityPrivilege 4656 powershell.exe Token: SeCreatePagefilePrivilege 4656 powershell.exe Token: SeBackupPrivilege 4656 powershell.exe Token: SeRestorePrivilege 4656 powershell.exe Token: SeShutdownPrivilege 4656 powershell.exe Token: SeDebugPrivilege 4656 powershell.exe Token: SeSystemEnvironmentPrivilege 4656 powershell.exe Token: SeRemoteShutdownPrivilege 4656 powershell.exe Token: SeUndockPrivilege 4656 powershell.exe Token: SeManageVolumePrivilege 4656 powershell.exe Token: 33 4656 powershell.exe Token: 34 4656 powershell.exe Token: 35 4656 powershell.exe Token: 36 4656 powershell.exe Token: SeDebugPrivilege 4524 powershell.exe Token: SeIncreaseQuotaPrivilege 4524 powershell.exe Token: SeSecurityPrivilege 4524 powershell.exe Token: SeTakeOwnershipPrivilege 4524 powershell.exe Token: SeLoadDriverPrivilege 4524 powershell.exe Token: SeSystemProfilePrivilege 4524 powershell.exe Token: SeSystemtimePrivilege 4524 powershell.exe Token: SeProfSingleProcessPrivilege 4524 powershell.exe Token: SeIncBasePriorityPrivilege 4524 powershell.exe Token: SeCreatePagefilePrivilege 4524 powershell.exe Token: SeBackupPrivilege 4524 powershell.exe Token: SeRestorePrivilege 4524 powershell.exe Token: SeShutdownPrivilege 4524 powershell.exe Token: SeDebugPrivilege 4524 powershell.exe Token: SeSystemEnvironmentPrivilege 4524 powershell.exe Token: SeRemoteShutdownPrivilege 4524 powershell.exe Token: SeUndockPrivilege 4524 powershell.exe Token: SeManageVolumePrivilege 4524 powershell.exe Token: 33 4524 powershell.exe Token: 34 4524 powershell.exe Token: 35 4524 powershell.exe Token: 36 4524 powershell.exe Token: SeIncreaseQuotaPrivilege 4524 powershell.exe Token: SeSecurityPrivilege 4524 powershell.exe Token: SeTakeOwnershipPrivilege 4524 powershell.exe Token: SeLoadDriverPrivilege 4524 powershell.exe Token: SeSystemProfilePrivilege 4524 powershell.exe Token: SeSystemtimePrivilege 4524 powershell.exe Token: SeProfSingleProcessPrivilege 4524 powershell.exe Token: SeIncBasePriorityPrivilege 4524 powershell.exe Token: SeCreatePagefilePrivilege 4524 powershell.exe Token: SeBackupPrivilege 4524 powershell.exe Token: SeRestorePrivilege 4524 powershell.exe Token: SeShutdownPrivilege 4524 powershell.exe Token: SeDebugPrivilege 4524 powershell.exe Token: SeSystemEnvironmentPrivilege 4524 powershell.exe Token: SeRemoteShutdownPrivilege 4524 powershell.exe Token: SeUndockPrivilege 4524 powershell.exe Token: SeManageVolumePrivilege 4524 powershell.exe Token: 33 4524 powershell.exe Token: 34 4524 powershell.exe Token: 35 4524 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2432 41589419116464448286035679864158972845276735013687.tmp 4544 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 4544 AcroRd32.exe 2984 regsvr32.exe 4544 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3492 wrote to memory of 1960 3492 41589419116464448286035679864158972845276735013687.exe 83 PID 3492 wrote to memory of 1960 3492 41589419116464448286035679864158972845276735013687.exe 83 PID 3492 wrote to memory of 1960 3492 41589419116464448286035679864158972845276735013687.exe 83 PID 1960 wrote to memory of 4804 1960 41589419116464448286035679864158972845276735013687.tmp 86 PID 1960 wrote to memory of 4804 1960 41589419116464448286035679864158972845276735013687.tmp 86 PID 1960 wrote to memory of 4804 1960 41589419116464448286035679864158972845276735013687.tmp 86 PID 4804 wrote to memory of 4296 4804 cmd.exe 88 PID 4804 wrote to memory of 4296 4804 cmd.exe 88 PID 4804 wrote to memory of 4296 4804 cmd.exe 88 PID 4804 wrote to memory of 2188 4804 cmd.exe 92 PID 4804 wrote to memory of 2188 4804 cmd.exe 92 PID 4804 wrote to memory of 2188 4804 cmd.exe 92 PID 2188 wrote to memory of 2432 2188 41589419116464448286035679864158972845276735013687.exe 93 PID 2188 wrote to memory of 2432 2188 41589419116464448286035679864158972845276735013687.exe 93 PID 2188 wrote to memory of 2432 2188 41589419116464448286035679864158972845276735013687.exe 93 PID 2432 wrote to memory of 2984 2432 41589419116464448286035679864158972845276735013687.tmp 95 PID 2432 wrote to memory of 2984 2432 41589419116464448286035679864158972845276735013687.tmp 95 PID 2432 wrote to memory of 2984 2432 41589419116464448286035679864158972845276735013687.tmp 95 PID 2984 wrote to memory of 4656 2984 regsvr32.exe 99 PID 2984 wrote to memory of 4656 2984 regsvr32.exe 99 PID 2984 wrote to memory of 4656 2984 regsvr32.exe 99 PID 2984 wrote to memory of 4524 2984 regsvr32.exe 105 PID 2984 wrote to memory of 4524 2984 regsvr32.exe 105 PID 2984 wrote to memory of 4524 2984 regsvr32.exe 105 PID 2984 wrote to memory of 4472 2984 regsvr32.exe 111 PID 2984 wrote to memory of 4472 2984 regsvr32.exe 111 PID 2984 wrote to memory of 4472 2984 regsvr32.exe 111 PID 3124 wrote to memory of 4544 3124 explorer.exe 113 PID 3124 wrote to memory of 4544 3124 explorer.exe 113 PID 3124 wrote to memory of 4544 3124 explorer.exe 113 PID 4544 wrote to memory of 3284 4544 AcroRd32.exe 116 PID 4544 wrote to memory of 3284 4544 AcroRd32.exe 116 PID 4544 wrote to memory of 3284 4544 AcroRd32.exe 116 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117 PID 3284 wrote to memory of 4044 3284 RdrCEF.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe"C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\is-FA8PC.tmp\41589419116464448286035679864158972845276735013687.tmp"C:\Users\Admin\AppData\Local\Temp\is-FA8PC.tmp\41589419116464448286035679864158972845276735013687.tmp" /SL5="$501C4,1880700,795136,C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe" /VERYSILENT /SUPPRESSMSGBOXES3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4296
-
-
C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe"C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe" /VERYSILENT /SUPPRESSMSGBOXES4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\is-FRALO.tmp\41589419116464448286035679864158972845276735013687.tmp"C:\Users\Admin\AppData\Local\Temp\is-FRALO.tmp\41589419116464448286035679864158972845276735013687.tmp" /SL5="$A0034,1880700,795136,C:\Users\Admin\AppData\Local\Temp\41589419116464448286035679864158972845276735013687.exe" /VERYSILENT /SUPPRESSMSGBOXES5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\CluelessStork.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll' }) { exit 0 } else { exit 1 }"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{14556AE9-B7F9-43B6-A44B-EF81D5CAA8CE}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
C:\Windows\SysWOW64\explorer.exe"explorer" C:\Users\Admin\AppData\Roaming\new_document.pdf7⤵
- System Location Discovery: System Language Discovery
PID:4472
-
-
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\new_document.pdf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=80FF53341566AB28FB9C3E42884567FF --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4044
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B2817EEAFE0D5714FE953712C17661DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B2817EEAFE0D5714FE953712C17661DD --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:764
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E50EE9FAFEA7A5E54713427F18048E46 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:1168
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F4594C25E8CABF9702118D23A881D52B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F4594C25E8CABF9702118D23A881D52B --renderer-client-id=5 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:4824
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=12B020B9D6B91FEC7C5499F935E89AF3 --mojo-platform-channel-handle=2628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2588
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=815D8B629F04DC900B6E8ADD5421EE8F --mojo-platform-channel-handle=2860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:1508
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2976
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll1⤵PID:4344
-
C:\Windows\SysWOW64\regsvr32.exe/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1212 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll' }) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4844
-
-
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll1⤵PID:3476
-
C:\Windows\SysWOW64\regsvr32.exe/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2760 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\CluelessStork.dll' }) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3456
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
64KB
MD50da4fbadfe41831eb7915c5452bcbcd4
SHA1b76c8bf3645a1716a278dc6574d8165d987318e2
SHA256cccb80d0f63802e806b3ca803f35d8f657246f66154b05cf3f7519d34993d004
SHA512500bfc6b278304d0aba2a7fb465075081daefca009608563e33df7d865d49e2c6aecc55abaf0a757646b8e934b56f91bd4033c0da83f07a48cdef176bc909ce0
-
Filesize
2KB
MD59751fcb3d8dc82d33d50eebe53abe314
SHA17a680212700a5d9f3ca67c81e0e243834387c20c
SHA256ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7
SHA51254907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709
-
Filesize
21KB
MD5903cfb20df5bde5d658e05c3dfa5346c
SHA136c373d3f42d95c7bcbcbe8bd7e291c80e27a660
SHA25624d5c2c634a50cab3080212087ca1e2d7d288af80c74336b33d8deb28b5f1df5
SHA5120b37aad41f009dae8770539d8de2fdc3b20e562ee8f5aecf415fe42a8191a7432be0058ebe5b88d410f32884682af8f96393408adabd0ed6301c7c61450d48a5
-
Filesize
20KB
MD587d27d894072dbcdae144f36253941e9
SHA1acaac3d6fef14f0c1a2f57d29c6fa493d63181d6
SHA2568437d029f238f478f09820f49f92871b570bba632c765173f1873d844a0b1f02
SHA5126d945604d50732c663b0d63f912313f7b454d8c7fb6b15cc5775c1ec432f01e3d0eb782d4287b3cbf231d98b40d19997e2dca6a0fe88d17b0e14f93cdeb07bb9
-
Filesize
20KB
MD51d11170672c3a451b038b58de0b12450
SHA1e59bbf2f7762b17db96f1a4c0869bb6519116cc3
SHA25623a766275e48d11c8897ab3cd719f762410382f423489dcc822bc4e1db138957
SHA5123a78987d168cd03982346153f50e5df6e475be17d52063e13a4cfe919f9e7d1baf382ef6ac31ae4c640d1153b720d285d22636a19627156a89a4392e8d5ef50d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\is-FA8PC.tmp\41589419116464448286035679864158972845276735013687.tmp
Filesize3.1MB
MD5e97363b64f37ee24cdd55cea14d1c564
SHA1dd82ae5ebf33348011b0437fe8107d4d72b9e2b9
SHA256ade1473799360f3df1cb0f8f20fa99e325009fb53e151236d0a2be6f041a8c8c
SHA512362bdf700ddd9186e9207351f0b8879f303c8c669b4bea2327ba549e18f7a333e11f4dc07cc2721ac18fdcdee04a8362ae6b4cdbdc961d220e154fa6de32182b
-
Filesize
2.8MB
MD55d12e174483a3ffe2c2c500e307fdc8a
SHA1b32a8018e88633775bb9b6bd708ddce03699de37
SHA2562ae1ba32a40756b38d7544aff09b77e72c6cffdcaf05758fa7d3edd2d9b21f56
SHA51227453a456b36b8ad018dc8801cb28f08da89acc2c99b7f76f199ef9694f350810bfd404eda650e3eb889c9a7cf41e2117c66d30efb26ecfa80c094f353f4183e
-
Filesize
85KB
MD5fe3e7701f1a41cf4f92d1e6fc7efbf5c
SHA105fac77a598118e7fc47b70cb5f38d5b27409ae1
SHA256c236dd48e3e528022b3205cefcd0daab16c759d0c8aea96ae2399eefecc639d0
SHA5129df1892c71771b94560eeb9e86b0afc69d010463d34daf84bcd91ac56ab1d1ae4ca93d6791b3e70343dd09d9d63900f8ee99df73c66d5188a89b790ba3c7976f