Analysis
-
max time kernel
77s -
max time network
80s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
19-12-2024 19:20
Static task
static1
Behavioral task
behavioral1
Sample
Remcos Professional Cracked By Alcatraz3222.zip
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral2
Sample
Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe
Resource
win10ltsc2021-20241211-en
General
-
Target
Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe
-
Size
17.7MB
-
MD5
efc159c7cf75545997f8c6af52d3e802
-
SHA1
b85bd368c91a13db1c5de2326deb25ad666c24c1
-
SHA256
898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
-
SHA512
d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
SSDEEP
393216:GYuGvp8EHb+in8f4Zg41+Q4AXf5ZZcyfHDMxVpSc+q+eOFxdx:3mqSi8fN4sAXfrZcyfo7p0eYHx
Malware Config
Extracted
njrat
0.7d
HacKed
dllsys.duckdns.org:3202
3b570ffeeb3d34249b9a5ce0ee58a328
-
reg_key
3b570ffeeb3d34249b9a5ce0ee58a328
-
splitter
svchost
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3620 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000\Control Panel\International\Geo\Nation Remcos Professional Cracked By Alcatraz3222.exe -
Executes dropped EXE 2 IoCs
pid Process 3448 Remcos Professional Cracked By Alcatraz3222.exe 2428 taskhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3448 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4648 set thread context of 2428 4648 Remcos Professional Cracked By Alcatraz3222.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Remcos Professional Cracked By Alcatraz3222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Remcos Professional Cracked By Alcatraz3222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff Remcos Professional Cracked By Alcatraz3222.exe Set value (int) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Remcos Professional Cracked By Alcatraz3222.exe Set value (int) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Remcos Professional Cracked By Alcatraz3222.exe Set value (str) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Remcos Professional Cracked By Alcatraz3222.exe Set value (int) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e003100000000009359ab9a100054656d7000003a0009000400efbe8b594f779359ab9a2e00000018090400000002000000000000000000000000000000c9db0301540065006d007000000014000000 Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 Remcos Professional Cracked By Alcatraz3222.exe Set value (int) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 50003100000000008b59e07910004c6f63616c003c0009000400efbe8b594f779359aa9a2e000000170904000000020000000000000000000000000000004785c3004c006f00630061006c00000014000000 Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 68003100000000009359ad9a10004255494c44457e310000500009000400efbe9359ad9a9359ad9a2e0000003862040000002800000000000000000000000000000057d055004200750069006c00640065007200500072006f00660069006c0065007300000018000000 Remcos Professional Cracked By Alcatraz3222.exe Set value (int) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 Remcos Professional Cracked By Alcatraz3222.exe Set value (str) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" Remcos Professional Cracked By Alcatraz3222.exe Set value (int) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff Remcos Professional Cracked By Alcatraz3222.exe Set value (int) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2" Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Remcos Professional Cracked By Alcatraz3222.exe Set value (int) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Remcos Professional Cracked By Alcatraz3222.exe Set value (int) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c004346534616003100000000008b594f77120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe8b594f779359aa9a2e00000004090400000002000000000000000000000000000000aee209014100700070004400610074006100000042000000 Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff Remcos Professional Cracked By Alcatraz3222.exe Key created \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Remcos Professional Cracked By Alcatraz3222.exe Set value (data) \REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4648 Remcos Professional Cracked By Alcatraz3222.exe 3448 Remcos Professional Cracked By Alcatraz3222.exe 3448 Remcos Professional Cracked By Alcatraz3222.exe 3448 Remcos Professional Cracked By Alcatraz3222.exe 3448 Remcos Professional Cracked By Alcatraz3222.exe 4648 Remcos Professional Cracked By Alcatraz3222.exe 4648 Remcos Professional Cracked By Alcatraz3222.exe 4648 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 4648 Remcos Professional Cracked By Alcatraz3222.exe Token: SeDebugPrivilege 2428 taskhost.exe Token: 33 2428 taskhost.exe Token: SeIncBasePriorityPrivilege 2428 taskhost.exe Token: 33 2428 taskhost.exe Token: SeIncBasePriorityPrivilege 2428 taskhost.exe Token: 33 2428 taskhost.exe Token: SeIncBasePriorityPrivilege 2428 taskhost.exe Token: 33 2428 taskhost.exe Token: SeIncBasePriorityPrivilege 2428 taskhost.exe Token: 33 2428 taskhost.exe Token: SeIncBasePriorityPrivilege 2428 taskhost.exe Token: 33 2428 taskhost.exe Token: SeIncBasePriorityPrivilege 2428 taskhost.exe Token: 33 2428 taskhost.exe Token: SeIncBasePriorityPrivilege 2428 taskhost.exe Token: 33 2428 taskhost.exe Token: SeIncBasePriorityPrivilege 2428 taskhost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3448 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3448 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3448 Remcos Professional Cracked By Alcatraz3222.exe 3448 Remcos Professional Cracked By Alcatraz3222.exe 3448 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4648 wrote to memory of 3448 4648 Remcos Professional Cracked By Alcatraz3222.exe 84 PID 4648 wrote to memory of 3448 4648 Remcos Professional Cracked By Alcatraz3222.exe 84 PID 4648 wrote to memory of 3448 4648 Remcos Professional Cracked By Alcatraz3222.exe 84 PID 4648 wrote to memory of 3016 4648 Remcos Professional Cracked By Alcatraz3222.exe 89 PID 4648 wrote to memory of 3016 4648 Remcos Professional Cracked By Alcatraz3222.exe 89 PID 4648 wrote to memory of 3016 4648 Remcos Professional Cracked By Alcatraz3222.exe 89 PID 4648 wrote to memory of 1816 4648 Remcos Professional Cracked By Alcatraz3222.exe 91 PID 4648 wrote to memory of 1816 4648 Remcos Professional Cracked By Alcatraz3222.exe 91 PID 4648 wrote to memory of 1816 4648 Remcos Professional Cracked By Alcatraz3222.exe 91 PID 1816 wrote to memory of 1296 1816 cmd.exe 93 PID 1816 wrote to memory of 1296 1816 cmd.exe 93 PID 1816 wrote to memory of 1296 1816 cmd.exe 93 PID 4648 wrote to memory of 744 4648 Remcos Professional Cracked By Alcatraz3222.exe 95 PID 4648 wrote to memory of 744 4648 Remcos Professional Cracked By Alcatraz3222.exe 95 PID 4648 wrote to memory of 744 4648 Remcos Professional Cracked By Alcatraz3222.exe 95 PID 4648 wrote to memory of 2428 4648 Remcos Professional Cracked By Alcatraz3222.exe 97 PID 4648 wrote to memory of 2428 4648 Remcos Professional Cracked By Alcatraz3222.exe 97 PID 4648 wrote to memory of 2428 4648 Remcos Professional Cracked By Alcatraz3222.exe 97 PID 4648 wrote to memory of 2428 4648 Remcos Professional Cracked By Alcatraz3222.exe 97 PID 4648 wrote to memory of 2428 4648 Remcos Professional Cracked By Alcatraz3222.exe 97 PID 4648 wrote to memory of 2428 4648 Remcos Professional Cracked By Alcatraz3222.exe 97 PID 4648 wrote to memory of 2428 4648 Remcos Professional Cracked By Alcatraz3222.exe 97 PID 4648 wrote to memory of 2428 4648 Remcos Professional Cracked By Alcatraz3222.exe 97 PID 2428 wrote to memory of 3620 2428 taskhost.exe 100 PID 2428 wrote to memory of 3620 2428 taskhost.exe 100 PID 2428 wrote to memory of 3620 2428 taskhost.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222\Remcos Professional Cracked By Alcatraz3222.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222\Remcos Professional Cracked By Alcatraz3222.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3448
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe" "%temp%\Profile Remcos\Update_Lock_Remcos.exe" /Y2⤵
- System Location Discovery: System Language Discovery
PID:3016
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f3⤵
- System Location Discovery: System Language Discovery
PID:1296
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\Profile Remcos\Update_Lock_Remcos.exe:Zone.Identifier2⤵
- System Location Discovery: System Language Discovery
PID:744
-
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskhost.exe" "taskhost.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3620
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.4MB
MD5c3c21fa4c2186deb641455482ab0d3aa
SHA12f4b49e8383e073ccb965943ce970de403412567
SHA2564ea203509d0fdff3e31f976413c546ca3d36133bc708e9a1301860961cc3a8d9
SHA51231db2963f1bd49f7b4a6ee38e54940d20120d6c05ef7bf34ec97eb93051bee6d5428e9e1271e4ae8f5544b824188ac7278315e2e2c27be302a312eebbf8c3fb7
-
Filesize
881B
MD5a3468935e33e361cf94f4721ed4cb66d
SHA1c3b19ca8382534b2179940cabede8c6c952a9c06
SHA256b374af58c24b6085f64f979dab434643da39d0267a27975f396473327dc98c7d
SHA512c1caa0b9637a46187d54b2952db204182fad5a5324574949ce4db13bdb17624ccd8b3228eb9b2bcfe5851add2c5d2f586945e7264b1d1cd02d91acf1fd81583a
-
Filesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be