remcos | hxxps://gofile[.]io/d/8utmKP

Analysis

max time kernel
42s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
16-12-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/8utmKP

Score

10^/10

remcos moon defense_evasion discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

3.8.0 Light

Botnet

moon

204.10.194.175:4444

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
WindowsUpdater.exe
copy_folder
WindowsUpdater
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%SystemDrive%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-4GSXVB
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
WindowsUpdater
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2416	moon.exe
1080	ohio.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	ohio.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\moon.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	moon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ohio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133788524417542033"	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\moon.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe
Token: SeShutdownPrivilege	3068	chrome.exe
Token: SeCreatePagefilePrivilege	3068	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe
3068	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3184	3068	chrome.exe	77
PID 3068 wrote to memory of 3184	3068	chrome.exe	77
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 3464	3068	chrome.exe	78
PID 3068 wrote to memory of 4428	3068	chrome.exe	79
PID 3068 wrote to memory of 4428	3068	chrome.exe	79
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80
PID 3068 wrote to memory of 2716	3068	chrome.exe	80

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4656	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/8utmKP
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94df9cc40,0x7ff94df9cc4c,0x7ff94df9cc58
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3056,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3752,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3464,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4704,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4956,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5188,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5196,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5012,i,323993228095241696,2660590735993280573,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2108
- C:\Users\Admin\Downloads\moon.exe
  "C:\Users\Admin\Downloads\moon.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\ohio.exe
    "C:\Users\Admin\AppData\Local\Temp\ohio.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\ohio.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4656

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d27e88c5a055ab930c8b8142a2aa580d

SHA1
015a55dd412d619389add10ee5f20d0297e5dbdc

SHA256
3ca68cdd25a531cef179eb0e59f2f2162d57548fe9462306d9f63e5d4408a7be

SHA512
40ec18b254044ad6d60fe1980590f618d3a231936ef6e7b6e286e13ba89e2fe428c273417484094a1a2a3b2e6159c4014ff956aef3d8f5ea116be9e9ec6750dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
2f89d1e4b42389567ca977f8110ddca9

SHA1
c8cfe414324abb57b3c6a84c7409a66408b59f6f

SHA256
a3be2cf45f7c148d21d0ea3888e22335df3e0a12e1b362ad6e9d361a76777e8c

SHA512
4eb1a79e5a642f8cbbd99fa8f51359971420e0fb0c9cdb2ec69a6870d784d9c1db3104e8f048fa8e153cfdd6dd28d151bc06f1b540cc3979462f86438bd0d2ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
852B

MD5
deebb61b283b0ccdb855dfa303271ef5

SHA1
47837a0f8c3e5769000828614772efd0208ae7a3

SHA256
2ee8b6a1e4274d939562c711f1741c44372bc0179409db051dd98cab959c2e56

SHA512
de1fcaad9a8cbc814ae891c1b18c04dab7786ca18ea7fc93d6a74a3787ad301cd20ba5710e06eae7ac30d9febd9cd743db5a41d2dfc475ce43b5c55be277e65b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d6bcfdce575fa3222ff648958a840b6a

SHA1
62286358e3e9f13c177e3bb04c749354dde73cf7

SHA256
0ab7dd7835b26942c8bdea2f2c00a0e4ffdd2b64553f995fc5452fca43e10d93

SHA512
11cb1eb0cda92e53412cd243d85252776d7683a91d5071d328c5089123dfed9cc3b9be979bcbce67413e4a82953031d1f9b43c7037aca50d253dd6281fb85f49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
25f6d6a2f327fa8aed2746bfce8ba366

SHA1
388582b7f590e76aea861d0a76c3195a5892fea7

SHA256
c7a286ea6a08601b68fba228d63b2bab5e3da68385eabb344b868b15fdae4e27

SHA512
e4789d910cbf86aab4dfb983e1c3c62f9fb3d2cbd4c765431a2245800775356aa5dd2ec4302b19375845b762ba2ab5875575a1e8a4f27d7b493dc4553d7f1f65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
34e4f4279cd35288dbd421591a29548c

SHA1
b74668a0011a25abf160cb3ae77c5f870c9e86db

SHA256
2fbfc81ef770837dd4a0830deab3688338325ec39a84d029cefdbaf0ced68301

SHA512
a8fc1a7e4f31176b8315f3aee8136c59fb41c2ed3a74225f61143b1f22ed12877c6bda1868bdf7e79395ef46f040cc12e4256e9840272fab8dc62249e1b3479e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
3a391d76bd53b2b61f25705655f027a0

SHA1
6ddc63d4b252a94d09762b29cce6ebc92777f4a1

SHA256
b2aeb126c36fa6478a6edec0bbf06e3384ff833843cd927909a69aa065e7fa18

SHA512
159ca506bfc626f336a07f4788041bded0267171ac2d2e54066fd216372a0c4570db7c8f074b1dae5b6aeae8e2ca1153e39808782364e6a3b1b02e5187b7e6b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
0677d11a02463e9b4f9a0c30a5b49787

SHA1
991333bbf5b213cb38a512ba8455902c3093bb0f

SHA256
e1c60345cdef642b23a1ac8f96ed24931560ae1316be14fd79f1bf002369e643

SHA512
f6527287ff0fb768ac30905209a135a0f3de81a503cea6407b12e8f255ed0f8e1839dd6e37867d541c014afcc8cffbd636317114e46c4acfaa008dfe217a71fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ohio.exe

Filesize
9.5MB

MD5
072973328deaba02a112a2fc8f60411f

SHA1
15ac4f0fd65e19fd358893e47dabb601db9de87b

SHA256
e817aa0ee9f05391d147550cea684eb4b929060643e181ac75d96f3f8a29af25

SHA512
c19ea06e9929dba58e48ab03cbc76de45f22a1bb2ca136117e21cec71cc828c099aa53ede2713fe4e81f30a91a407e15e7ec347389b5cc5df6dacc9fcb05f94f

Download Submit
C:\Users\Admin\Downloads\moon.exe

Filesize
423KB

MD5
b1c7d8102bcab505d2fdec27282767f3

SHA1
4f3496b126eabcd57335e2a315d59bdd2e043c89

SHA256
010b6fa39f761c1444233c206b2c4434428a75ff9d0583bcb84b12e2804340db

SHA512
c1da6810dbcf11b582f80820f55279258a5779eb420ec5a19b9da04a3d90dc37febb841e50d54be55b2fc447d77fd8f775a1e6f5ac7e8e10acb35bbbf8ce6748

Download Submit
C:\Users\Admin\Downloads\moon.exe:Zone.Identifier

Filesize
58B

MD5
f328e184c322cba91dc3c014fe2ef3e9

SHA1
2aab1f0a70009051dcc87350e0f3b079da02fbb2

SHA256
fe25e31061b432c3a3fdd8f797c6dadad253e83dfb305ee997a7302cd70b618d

SHA512
e59501b550ea64155d134ae832812004ec298a44519eb03183542599174b7691be3225f6fa5064d45ed7ec81f0a93721eb8f401d7e2a49c4b91a70ded006c97e

Download Submit