remcos | f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
Size

1.0MB
MD5

01366b2e0ca4523828110da357d12653
SHA1

80a4c110832923d56d4b86a10adf357e1839c7b8
SHA256

f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024
SHA512

b4e21bb81c0134eec03a37ad171a73c6a501891717656a590ac94e2defe255f4fcc13a65b2e69d6652d6ba8f2264f883472be56c548c2e8cc15c132de88a567d
SSDEEP

24576:X1azvpEnO/9uGgmyB7KMXEHB036bTTOz9Rs:X1kpEg9uBOsEHbsS

Score

10^/10

remcos remotehost discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

192.3.64.152:2559

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-ZFXG9Y
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2976	powershell.exe
2884	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 2688 set thread context of 1612	2688	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAD1E2E1-C4C7-11EF-8C6C-D686196AC2C0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000036060a0d698d1a4eac37ccbfd6ae1ef700000000020000000000106600000001000020000000ec6a41434a468b93e335c8f04615984c3119c1ae6c2b011b8a3de48c854c63f1000000000e800000000200002000000024e6f77f0dc230d32319b1fc5798e6af8a07ff807e9d81b366b2ab584d36a8069000000008ab5aa46b7be6745aec6732c41df30ef5ed62850ec9c2d5ff76fd4989704d8cf21733cd0cb17419dd9c241383c538bb4a225274fe61e31921177a8218294ce1f0fd124fe84fd5ee19bde47c3c57385c3a06b2951671a586d93ea6809efe61405321eae416334035c6937a6f061a828d86e7294bc903d795d942c6871315e05bbe0a42e5476edbd0c7e7feddcde162df4000000071fe10dcac0c21dacf9be45170537d56261538e2b3030fef66f69a2c4a27c229e1ebf606ae62657fda1c351bbf2da8e8487c8fad0a5a6c64577afc8616b1d226	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0382492d458db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000036060a0d698d1a4eac37ccbfd6ae1ef700000000020000000000106600000001000020000000869290ccde469c86e60ba239a2aab62d20c7007fe35be24496199d949bd69c93000000000e8000000002000020000000859ab0ee0863e333c66cf958c406003bb232e269e11b8f8e52b18e17c75a8b6220000000f5a04a78107fb6888384938b794f31568f7f518d202ab6e741cfa4f0553f8e504000000006537ecbf4447ee11329bf7d280a040e6b09c102b2ef78634da613555c4bc94565aba04fb4cdcbc80a35383985ec1635d01b9f1d38cf9dd8cd0ce856a0418356	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441516625"	iexplore.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
2688	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
2884	powershell.exe
2976	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2688	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2976	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	31
PID 1828 wrote to memory of 2976	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	31
PID 1828 wrote to memory of 2976	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	31
PID 1828 wrote to memory of 2976	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	31
PID 1828 wrote to memory of 2884	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	33
PID 1828 wrote to memory of 2884	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	33
PID 1828 wrote to memory of 2884	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	33
PID 1828 wrote to memory of 2884	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	33
PID 1828 wrote to memory of 2888	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	34
PID 1828 wrote to memory of 2888	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	34
PID 1828 wrote to memory of 2888	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	34
PID 1828 wrote to memory of 2888	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	34
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 1828 wrote to memory of 2688	1828	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	37
PID 2688 wrote to memory of 1612	2688	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	38
PID 2688 wrote to memory of 1612	2688	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	38
PID 2688 wrote to memory of 1612	2688	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	38
PID 2688 wrote to memory of 1612	2688	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	38
PID 2688 wrote to memory of 1612	2688	f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe	38
PID 1612 wrote to memory of 1952	1612	iexplore.exe	39
PID 1612 wrote to memory of 1952	1612	iexplore.exe	39
PID 1612 wrote to memory of 1952	1612	iexplore.exe	39
PID 1612 wrote to memory of 1952	1612	iexplore.exe	39
PID 1952 wrote to memory of 1824	1952	iexplore.exe	40
PID 1952 wrote to memory of 1824	1952	iexplore.exe	40
PID 1952 wrote to memory of 1824	1952	iexplore.exe	40
PID 1952 wrote to memory of 1824	1952	iexplore.exe	40

C:\Users\Admin\AppData\Local\Temp\f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
"C:\Users\Admin\AppData\Local\Temp\f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gorfVgTf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gorfVgTf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1E79.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe
  "C:\Users\Admin\AppData\Local\Temp\f977974b2df2bece2382b3c31b24382b629d18144c1fd56901900b1d1aba6024.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2688
- - \??\c:\program files (x86)\internet explorer\iexplore.exe
    "c:\program files (x86)\internet explorer\iexplore.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

Filesize
579B

MD5
f55da450a5fb287e1e0f0dcc965756ca

SHA1
7e04de896a3e666d00e687d33ffad93be83d349e

SHA256
31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

SHA512
19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

Filesize
252B

MD5
19572e8ecb3d12e46b03a1e879ddf307

SHA1
35a370c14a429eb8fda92bbec6fbcd034e157c82

SHA256
7bafcdf40176ef885bea9d98aeb7acc7a21327d2f01c0ba00de718f79368f0e3

SHA512
ac27134db74cb3dda9255221b8f5d62607b7195167b9eb1c16af12302f818b1dd56686904900a29c686e31c6958888874f45d861a7f778955ffeeabf82d6e363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01cf2c36e46a78f8009c053fe3146206

SHA1
ce39c65c21b529d7d1b31a87624519c5364c3131

SHA256
e52aed08fefcd72babfcbe244e5df7aa62005f00d85345c44ee49ce0f913c8db

SHA512
748435e6b49081162deb43304fab2dfac6567d97b44b4be3527dbf0dce460c9dda14c021ee1fc351eaed4c6d3a73a68fc0da3541085aaf64323558f31d35aa00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e608a0bbf857c10ead2a72e6f5a2cf2

SHA1
c2cf26150b761178ad45a983a3030a0383f2d01a

SHA256
469326400575dc974bf5edbf7276654b02476ff77cbd2af5f3b906f7f8ebcb8e

SHA512
69e146b224326fdcb10c32959cae0bace491c0a34da93f4bbc9b3450f0560d72361c4c45e35f9fb858e2815974f0d0a8007edf79d1129b2c8d9ac9c29be4db04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cba083763976a2ef2c31f641c302967c

SHA1
2c1395cf4792e7e3bc91197f7596287aee7561a7

SHA256
6c79095d5b537041e3ac8afc05f246b5de175d95cf1ce27e1346c79921e66f38

SHA512
7dc0764404f23fa25adb4a7ca4ad57c120b817368716f6a0b6b977a1e135ea2420a5461bf972f290773b1415e9fe45cb016590ed19dea2c9b471b154c5f694c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82cd9841d46caea225dd2908bffeb0c1

SHA1
44283d54d1ed3a3b2f31515f3b77319851160248

SHA256
acd7229577c4eacf02d3a63736e55bdf98a962a697a0158ad0d5159dd9e83527

SHA512
31c925a34d9cd6e04917bd0c2ab68ed8d79545b05a6fd29cd13dc2894fde251bf6c490736ff580dda9fe241413878b5d8f01435044818284ff6e9153433a80a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6723bbfa51d8c5cc82ebc2a0582a329

SHA1
17eec0b2853ef07a9fef357af088c64f9629b7a4

SHA256
a321768f2b1895b99ed85a66bf81f0db2e5dd140ce1c5cb770c8b4b551dfb5f0

SHA512
bb30fa7dd3709d42960c467181caf57585ffd2d02a58d359eff18ba22591b2422d264a3b602e5aa47d9261500d4d9b59918de4fa94f4e6004436244b7778dc61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed4b34fe0ad58eafdcd9b7deb6f9c5b6

SHA1
47ebce297ef4059f8554f5fdaddc28cf8d482845

SHA256
9e6b9dc959583e689c7913498f148ac42e41b522b00a9220ca7475afbe6da17a

SHA512
c798c6ae26f2ec753496126cc64afd676a9a9d84aa4ec95f945532421aca84988a167b13e3abe84b520b2f845cab9321956b339ae7062295f90d2d6e9e0fcd0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
600782742a6e180145940f8e6121e06c

SHA1
ab43a627683fa4180b39b37cec8e7a6d72d6e3f2

SHA256
ea2c59e95ac48dfa698a9ceeeb65860b6d83a35e9de01a568d204d89f38e9e4b

SHA512
7565f7b1f30a9412d8f9f3740d3f579d6a86e5e0dc3af8b254dd2fff428ed225f456977fdf949f90869332f4601bd643c192596982da0910d2a6b4785bb6b329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7caca0f3d3181d1894c5e3a84726d37c

SHA1
cea268196a741187b39301283d866c60642d315a

SHA256
5895932955b920fd64f8fd95e74b0147bc7e6925a1a6c86e24342026f7becc7f

SHA512
f35c548647ab4dc0283173aa6ae6599190816e2dfba17038c116ce80f4985d4b3521d4dabd8680a5bad5d04149ce7a635b6df615eb8d0f50942b250b4e6038c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
547dfc2a0ac706809bab28e155d4ae47

SHA1
3d8d609b32d68fc3a17fd21f885b306c99999c1f

SHA256
4bd794862274fcacaf3f53ff620422e4a558ced9cfa9950c26686e146f26c010

SHA512
34b8fcf31ef4f7fec8335cb2dc39339160019dd86454386240c39e0cd1fd33df0b6d71f03f23bb2d9a295222734e6480a7016253c890af31627a1d0ba34aa28d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d10376c60f97ac201705b30832e0d373

SHA1
7bccbc0256433b0a91d6f97503e66a2546479344

SHA256
7a50dddc16bc1757f9fa82f230ce54c54bc518f5fd9ef33fa92aed26e82f011b

SHA512
6e67e06c27e2cb5b274e488cf425a21e2098ac8d4f59f074ea186af57debcce99e5e3ab458eff08ffd5cbdb2bb3f21b89273174db0aac6b6464d2a77f983e890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8081df7ebed72dbc3ddfc1756ac7ee12

SHA1
25f6639917fa15e55af04bdf3857b22fb080076f

SHA256
55a3a5ce8a379c3b4e2e93ea443f9dbd9fb171c0ed76b8ec07cb40527427a128

SHA512
c43ba0c484ce216852942f351b5dc1023530d51ddc196642d804bd3b96151b733f0e1eb5ce81fc0ef028620506f5bbf142f2c342f65dcfa5978526c5c00fd90e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2205c67a06c47c0b1902b8f4eb3f1d9

SHA1
af27abac9f78de58d7ab0072fd28804ccdf1be88

SHA256
79e76fcfadc227b1bc5ee414185200a72f1325952e1cecfa046cec60ca97b4a0

SHA512
0ea37f6df6cbb20582a448c8c84811ec8b8be2fe2584e3c8aaa6897f9ce46fcbe193a1b68879f10f9158d9ad9a76e0a398de0b2bddbf9f616caddee81648b569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
093291ca9273cc900faceb2470d848e5

SHA1
8d6c34bcfeda38c5a0e731e8ffb2dd1aeb66ccfb

SHA256
5fe17631b5c11ddac32cec3b23990ab325de51840757fa00590d1c3831cca12f

SHA512
31a64e623b96ee504303abe7b259d101ac58d2d4c8e8f87d7048d7bc0392c7be82fc71f09027ca85b9737885eecc3a50de4ae489256dc94b129efc2ed61adab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d6cd8160eb82c655455bbfc7f93e945

SHA1
0b6b5612fb33827d1bfc52acc00366d0c74ce683

SHA256
f65abac27d11cbff96d622a54ed29d66d3a4f3bdff5f787a330e10233fa310ff

SHA512
85c83e4a58e31cc356a07a5685549c8f89e16a39f9f6b3f3d0c5e03cec4b33f28842c88a8aacecb247d5f185f4942c523d1b91ef780edc6bf5c19f6cb5d8eb7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
076e62caea63eb4ae5c3db57e38a130d

SHA1
d293b491b1d5507ab76908fc0519c5c62f9a8de2

SHA256
67d012a261d8f751b95b87d3f2cd9fe87214d152968559b098cd71da99db83b7

SHA512
cf9f15c1769d105060db391d90c39043b3a6d90e1ae62d67aaebb976f7a7e054440a3712ee6c9049cd49dc741900065934fe9a6676bf6d422f0fd718b8db9ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49d98f9f72618de10a8b31fa774918d5

SHA1
7e789e7d631019c0648c8cb5d0d035a8d0167555

SHA256
7280acbd3af3039d8c043ce0ef35dd814406b8ab525ad9ef4aae416bf5c5f447

SHA512
1e2315c2f2b4cb3ad99ddd3c3b0a6a4f6ffe07a218038ba1c7203a7709b3b683bcb2205a410e385eb1f1441741633ae068b76218ecae34e71cd2feb70823aabd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8b3963b07a06aa7719831e8f375d93f

SHA1
1baa96860cec94b8eb3bc8cebe5da6014a99595e

SHA256
823403e943669937ecbb9b320924f4acd9aeba890953a4c3fb26ff45daa437ac

SHA512
2c03e0e180d1d0c9b43f244c8ea3fc65ae10d1ca7ede8c162fc465873b6bbe70f1645b4d147c20e6ce4d3cb20b3b6d11192d88c682a70cd879bfbfa69e604c01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3033b9703461fdfc884c3d343b16ee7

SHA1
58a857e68c7a0a70704c14323a62b91639567427

SHA256
d85423ed7d02994d387852596d3f8d5a1d62ae1ed62fa3c298c2ea552180c07c

SHA512
5b2e895ccd79ccdafefcb717b370e8fccf40054922ebace8bfc79c0f35e33579c0c396d9605edc96588c5e0081a1a3a3fc3310dc74259de900bc76bd72cc4f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a7f858dd7e3ca785a1feee45949c2d9

SHA1
21137e72a31b896a41892834a3dc7740d87a7654

SHA256
61edf489cc349aed001db064cae303010e3d3931348ce00b128acffda5a657b8

SHA512
c804faee7b43df3093601326908ab61f0bb7c66ad163946895aff650e6341bef9452fc80a1d1d77c96b3bb06f091358e78aeecb5d20eec0a4494a3122d22df1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e86f9cbf34d24479e0ec994079717a19

SHA1
59d93e55f51b2acee01addff1c38d0cf6727cb24

SHA256
95bfa0d19e741077b1ea37954eab695197e8cacbc97bde44caa4bbc4c05a38f6

SHA512
fe1b52120cacff97d4298bbf7dfe4914e4433d9fa842bbfe72ab6622acf028ea3c11f5a5af9ca6bb2fb8f99f59a4f4447af1a05ac7518f934b609e59403b7656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68efa2b37527afcef66c34eb65eac091

SHA1
f3046f856663c18b5ce42adc8852ce2c6a8ad109

SHA256
637ad159070ebbeef318b83b9a35ddb80f0c72f8dbfd898c50e7162a002c543e

SHA512
56ecb0c6313b6986cffc30558db7e99af6c28c2bc07e5b82dd7cd74c72955e10d762d6a1d34edf6715a9a704d5b7d9a32693348c1c696e1b30486a37a63eb02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79c50bb1e48227c7bf5855712f8bf5b8

SHA1
2133dd800e1a0d88a2f1a6d53f5b2142909b3f4f

SHA256
597428657fecee0442a279a7dd7a67eb6b428c240a34da5198824753191cfbbf

SHA512
64485be33aac457315cf9a8e42f0cfa3433e25c8364640d07c1ad7563d19a40479e5846e5f1fbadd5e4f8796dc190fc741ad2322c1acd31576a5a80bac430768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d52b4f1f797ad8dc030275d2f8190935

SHA1
4d17095eb76ef29f6d8b890cb5599bafd4c367f8

SHA256
627cce1e63e93e56df218a6f59cff7c8e68ff69a80486a25f2598e127de447f9

SHA512
86534106c8ed466c903400e8a0e8c66277d3af22d8de470c72b61f33847ee965093d76bb53ece78335ae97dda55ddd09aeb5e1f3cef2a6630a43ae17847f5753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d6585b562ef532a173d89cb093aebdd

SHA1
5f11689e74df9c39bf76bc0dcb39fe3e156787df

SHA256
14f020cb04a2bd9802e12674191d1c7851f543e874448943c7e46d1dbb41b583

SHA512
52d36c04eccded419f8d0c4348d5c843af8b83f781b3527bbb0a3f804cbb16e06e31dc9e6c23b5d9a70b3a8e262d3970197fb4012da463da39886bf7d4df71ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab459A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar460A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1E79.tmp

Filesize
1KB

MD5
f5a16c978f1adeb607ebf0ce64a4eb3a

SHA1
1a2e0f480c4dbd4d9311bd676ee6ee3a37e9d24c

SHA256
3a7f6fad366de8693113807fc2580dcc739b6a5feb78a24b8e81867987cc4697

SHA512
badc049cf7d6f669ec8db08091012750de386c5ebefe9c802fbf6860e2b68e6610e5e98accd136cd8318de54fc74c99b60c7f317f9c833def94076211bcaf5a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GJC1KLDABDU5N9DBAOA4.temp

Filesize
7KB

MD5
8e85636b911b9fe6355613642e26047f

SHA1
9484385a47c3d7bf03c09997876e646022decf18

SHA256
5a334856ce6276e53a076ef4ab045f726a97d985099192281b5a0ca00cc94066

SHA512
d9e39fb3c47e90f3a7d571bddae3f712c00a5f532679825229789121a31bf3e4c519e9feee1775d5ba049cbd49d3517aeb7ac802907f1c11eefbb26de32f32c7

Download Submit
memory/1612-40-0x00000000002F0000-0x00000000003F6000-memory.dmp

Filesize
1.0MB

Download
memory/1612-41-0x00000000002F0000-0x00000000003F6000-memory.dmp

Filesize
1.0MB

Download
memory/1612-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1612-39-0x00000000002F0000-0x00000000003F6000-memory.dmp

Filesize
1.0MB

Download
memory/1828-42-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/1828-1-0x00000000013C0000-0x00000000014C6000-memory.dmp

Filesize
1.0MB

Download
memory/1828-2-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/1828-3-0x00000000003D0000-0x00000000003E8000-memory.dmp

Filesize
96KB

Download
memory/1828-4-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/1828-5-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/1828-6-0x0000000007550000-0x0000000007614000-memory.dmp

Filesize
784KB

Download
memory/1828-0-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/2688-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2688-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2688-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2688-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2688-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2688-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2688-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2688-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2688-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2688-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2688-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download