remcos | c3278553bbfd3a24ad3207c1360c979bfe5d023f39e103438c4f66987cdc1da1

Analysis

max time kernel
36s
max time network
37s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 14:54

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Ref. 56433905218740.exe
Size

1.2MB
MD5

2ed1d515b213dfafa2ac37fa4b9e8191
SHA1

b1f09651ad63871c2e41e2db2b29b9f2c3598b12
SHA256

4ee8706cd6bf820a75a528e933d35a306ac18d466cc989a3317be9f5be9c1e5e
SHA512

1a0b1e8430844e810f4c23806afa33b318f88d51e1f7aa2646d722d6c1293b7888d97b68e2680e1b8d30c324bc4cc9823782ee7c25b59347f8cab4a7ba3b1ba0
SSDEEP

24576:bN/BUBb+tYjBFHNuuNVEtaST6Zi23v2NEXiM0hD6di/A9n:JpUlRhNV7GaSTTw/XiM0hDTy

Score

10^/10

remcos remotehost collection discovery persistence rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

206.189.218.238:4782

206.189.218.238:2286

206.189.218.238:3363

206.189.218.238:3386

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-9IFJWE
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/1896-164-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1304-163-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/1472-158-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1472-158-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1304-163-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Executes dropped EXE 5 IoCs

pid	Process
2104	puachd.msc
2400	RegSvcs.exe
1304	RegSvcs.exe
1472	RegSvcs.exe
1896	RegSvcs.exe

Loads dropped DLL 5 IoCs

pid	Process
352	cmd.exe
2104	puachd.msc
2400	RegSvcs.exe
2400	RegSvcs.exe
2400	RegSvcs.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\qpjx\\PUACHD~1.EXE C:\\Users\\Admin\\AppData\\Roaming\\qpjx\\jtllpsq.3gp"	puachd.msc

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2104 set thread context of 2400	2104	puachd.msc	42
PID 2400 set thread context of 1304	2400	RegSvcs.exe	44
PID 2400 set thread context of 1472	2400	RegSvcs.exe	45
PID 2400 set thread context of 1896	2400	RegSvcs.exe	46

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	puachd.msc
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ref. 56433905218740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2240	ipconfig.exe
2512	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2104	puachd.msc
2104	puachd.msc
2104	puachd.msc
2104	puachd.msc
2104	puachd.msc
2104	puachd.msc
2104	puachd.msc
2104	puachd.msc
1304	RegSvcs.exe
1304	RegSvcs.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2400	RegSvcs.exe
2400	RegSvcs.exe
2400	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	RegSvcs.exe
Token: SeShutdownPrivilege	2400	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2400	RegSvcs.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2856	1460	Ref. 56433905218740.exe	30
PID 1460 wrote to memory of 2856	1460	Ref. 56433905218740.exe	30
PID 1460 wrote to memory of 2856	1460	Ref. 56433905218740.exe	30
PID 1460 wrote to memory of 2856	1460	Ref. 56433905218740.exe	30
PID 2856 wrote to memory of 2752	2856	WScript.exe	33
PID 2856 wrote to memory of 2752	2856	WScript.exe	33
PID 2856 wrote to memory of 2752	2856	WScript.exe	33
PID 2856 wrote to memory of 2752	2856	WScript.exe	33
PID 2856 wrote to memory of 352	2856	WScript.exe	35
PID 2856 wrote to memory of 352	2856	WScript.exe	35
PID 2856 wrote to memory of 352	2856	WScript.exe	35
PID 2856 wrote to memory of 352	2856	WScript.exe	35
PID 2752 wrote to memory of 2240	2752	cmd.exe	37
PID 2752 wrote to memory of 2240	2752	cmd.exe	37
PID 2752 wrote to memory of 2240	2752	cmd.exe	37
PID 2752 wrote to memory of 2240	2752	cmd.exe	37
PID 352 wrote to memory of 2104	352	cmd.exe	38
PID 352 wrote to memory of 2104	352	cmd.exe	38
PID 352 wrote to memory of 2104	352	cmd.exe	38
PID 352 wrote to memory of 2104	352	cmd.exe	38
PID 2856 wrote to memory of 2432	2856	WScript.exe	39
PID 2856 wrote to memory of 2432	2856	WScript.exe	39
PID 2856 wrote to memory of 2432	2856	WScript.exe	39
PID 2856 wrote to memory of 2432	2856	WScript.exe	39
PID 2432 wrote to memory of 2512	2432	cmd.exe	41
PID 2432 wrote to memory of 2512	2432	cmd.exe	41
PID 2432 wrote to memory of 2512	2432	cmd.exe	41
PID 2432 wrote to memory of 2512	2432	cmd.exe	41
PID 2104 wrote to memory of 2400	2104	puachd.msc	42
PID 2104 wrote to memory of 2400	2104	puachd.msc	42
PID 2104 wrote to memory of 2400	2104	puachd.msc	42
PID 2104 wrote to memory of 2400	2104	puachd.msc	42
PID 2104 wrote to memory of 2400	2104	puachd.msc	42
PID 2104 wrote to memory of 2400	2104	puachd.msc	42
PID 2104 wrote to memory of 2400	2104	puachd.msc	42
PID 2104 wrote to memory of 2400	2104	puachd.msc	42
PID 2104 wrote to memory of 2400	2104	puachd.msc	42
PID 2400 wrote to memory of 1304	2400	RegSvcs.exe	44
PID 2400 wrote to memory of 1304	2400	RegSvcs.exe	44
PID 2400 wrote to memory of 1304	2400	RegSvcs.exe	44
PID 2400 wrote to memory of 1304	2400	RegSvcs.exe	44
PID 2400 wrote to memory of 1304	2400	RegSvcs.exe	44
PID 2400 wrote to memory of 1304	2400	RegSvcs.exe	44
PID 2400 wrote to memory of 1304	2400	RegSvcs.exe	44
PID 2400 wrote to memory of 1304	2400	RegSvcs.exe	44
PID 2400 wrote to memory of 1472	2400	RegSvcs.exe	45
PID 2400 wrote to memory of 1472	2400	RegSvcs.exe	45
PID 2400 wrote to memory of 1472	2400	RegSvcs.exe	45
PID 2400 wrote to memory of 1472	2400	RegSvcs.exe	45
PID 2400 wrote to memory of 1472	2400	RegSvcs.exe	45
PID 2400 wrote to memory of 1472	2400	RegSvcs.exe	45
PID 2400 wrote to memory of 1472	2400	RegSvcs.exe	45
PID 2400 wrote to memory of 1472	2400	RegSvcs.exe	45
PID 2400 wrote to memory of 1896	2400	RegSvcs.exe	46
PID 2400 wrote to memory of 1896	2400	RegSvcs.exe	46
PID 2400 wrote to memory of 1896	2400	RegSvcs.exe	46
PID 2400 wrote to memory of 1896	2400	RegSvcs.exe	46
PID 2400 wrote to memory of 1896	2400	RegSvcs.exe	46
PID 2400 wrote to memory of 1896	2400	RegSvcs.exe	46
PID 2400 wrote to memory of 1896	2400	RegSvcs.exe	46
PID 2400 wrote to memory of 1896	2400	RegSvcs.exe	46

C:\Users\Admin\AppData\Local\Temp\Ref. 56433905218740.exe
"C:\Users\Admin\AppData\Local\Temp\Ref. 56433905218740.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\njnk.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c puachd.msc jtllpsq.3gp
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:352
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\puachd.msc
      puachd.msc jtllpsq.3gp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\isoyridcvmeukdyzhgk"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\tutjsanwjuxzurulqrwlsx"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\voybtsyxxcpexxiohcjnvkgkx"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /renew
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2512

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1572

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\akkvgnnbca.3gp

Filesize
582B

MD5
8895da9a47ea6ff02a277622160c6e00

SHA1
def4744002656cfe72ef784cd38e219f4ac938c6

SHA256
15547f9086ba0e57e5180958fa7e88fc00352cfe310e7d8f230c45a2799df1c8

SHA512
98ed4def73cc005a6e0ea6f16be297d4043a89b85935851440a918e523bbaf65418c11e6294482dc8cf3a6dedeadfeac37a98976ad9b1f394ddd3d39572bb238

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bwoclqaj.das

Filesize
515B

MD5
1e2250112e4d3d9b3611c24f242533a9

SHA1
0c4f4421fcf1a96855d5e5addfc98d216aef519c

SHA256
d7164364ac84fb0152498fac802ae96dab8ed74bf9888ebdf6c41ebecbe4ba4e

SHA512
ef7c834ea468faa9b43b14dd75bf0aa7ff33ff91a0d1acf37d2037bafceb292214534829f9a29f5c50c911419cc1bb4628ba30c4d7ee7e5913e05ae559460e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\fqiwhjd.dll

Filesize
534B

MD5
8810ab5507c9670118f05ac8cfe5dbd3

SHA1
16ed36c393129225834c39d50469584c121ea966

SHA256
5b7a5af5c268c2dee97fe2af4c1c847fa64d17ea66b957a17ad1754a311faaa6

SHA512
094435fb5ab2106a56864e2f62b19a6785507c45f2b57ccb15c29a0128263d6bd06a799cfb8201630739570b4fead3ed953e919759e0e8549c803120dfc74df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\fwajoo.das

Filesize
609B

MD5
fb79a72711721d9cf264ea3eee000b70

SHA1
79ffb687727e2e2b03a37aae32b546c8d06ceb19

SHA256
8da0f6e0e38eb20a7036124817c11856ede08758a119964b6de0cd54bf06c331

SHA512
57ec7eb71946853ceca327e89e1338c5ad9413e5b5344303d6e91858c182d26e82e2d03577a2744dc10998e48f35f9a612110db5b3e345e9c6e7acde55efe61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\jtjas.txt

Filesize
586B

MD5
39df90ccfb6b9184ba418e41e955ad84

SHA1
6422407acf2eb419aed8ce98d0db780b66b8d9be

SHA256
bf556c8c0b1b099a4318bb8947a1c9fe1a96d2b8f09a14dbf42cf6260d9aad37

SHA512
852dd8aef4453efa8a3f5aa1d9b95e479d356ea36713db27867c0d291fd631cd43f706c2442fc8d51cd5314ffa493d681553816a2934d7bc6faed13d0309d722

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mgbeebdm.msc

Filesize
571B

MD5
b82cc237e6a18bb253d375bf92319327

SHA1
aa678bdaa5c83948b551e11b306c8afeb5b03afb

SHA256
a644c7087793afcb8cfdbe3bf9d99bb5a45f18b1c293078c570c855ded567a15

SHA512
1df54f83119d3ebe4c2c0180fa8a41922f899fd01d2c87b0f6a64238c54876512dc3847988730da1ccec2dc2920172d89f71ed06a46b72fa1d544ed8c58078e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mrnf.mp3

Filesize
36KB

MD5
7d5ef9b8fc8ccf868fb5540a2e4a126d

SHA1
5739b2035acbeb00e057a7abc3cebfb2d801b41a

SHA256
45ed5474e480538082a0923cd2738fdacd7b5437b2386b5faea74e08ab720fd5

SHA512
8f1da31f9d10bc285ddaa7a481526658d186f3635e20166696795f7b07084e5f723bd95e834b754e595889ca585932e34aa2606d5c9cb087ba2a69a32fde539b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mrnf.mp3

Filesize
36KB

MD5
0b889b1ccd9faf5638a162d8d98d1331

SHA1
3c5fc5f452071648271e4e5368f54a382586cfde

SHA256
62fcf3a4f093f267fd54af93fce5a09608eba265f078345d9de40075a4931655

SHA512
e682764d2963d735c12d2e65461ad48b999a51f4f581b6aadd3cdcaac096ded8b5e959e975ddcfccdf219d8189c785dc499a034dc819412c50f1ef93e17f33e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\njnk.vbe

Filesize
169KB

MD5
2da4a3a52faa4deb9351d43d2368eb08

SHA1
88bb50331a8bded2395b50af9e81a43f0ee3545b

SHA256
42ea84f0ecd77198f23c0938eb87ed52815533a30421e6e21bbf3fb8832b6990

SHA512
564855fdaddbc2b7c681249fa10f01b5f1f64159476eae165d62eaae757c7e35486c2d4882342756c6865e0968332eaca23224cd842fc9d7e73572101e0f0fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\njppllwh.mp3

Filesize
527B

MD5
01c2585530a1f04b8f47545493d67741

SHA1
5ae85d6d6f17d616504ef2b15bc0237086198d11

SHA256
2a7015be009060a21ba031b95c837d0e54e9181a0c31191ae223d3fd874479e9

SHA512
ea8e4b2546beae1fbc4efa08911471f0be173ca5d352bc3d419f7432d3513324f4d5a89306b628aaf32a10e292faff91d1b74f6933461dd755642db590b92cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\nxftmchn.mp3

Filesize
595B

MD5
24d5381bcddbdaf550d33555eb151b13

SHA1
1206bb6e0c5903d785a75414fc42e491b89e599e

SHA256
d5ae7b557f0d0ef7928bfa6c95ddbadca354a0e590a01b4e301baa7f52f3ba4c

SHA512
0f3faff18f0de923ebb5c961e56022ace3aa735aad961f6f537cad5a48aed888d53458d930b57d47ad5f225249a83cc55d2f10c0ee2094cbbbade8122cb03910

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pgrkjrdrwr.docx

Filesize
552B

MD5
d341cf78d204d68df14329e5dc76736d

SHA1
fa84df15448222a4b50b4adcf4fa36ede79a2e50

SHA256
02ca4045fd519b75452e6f62e2b239804b3d31c604b3aaf46250e09191626aac

SHA512
6362051ba00881a26b24ebe2da9120d73d49265e097c59e6c43489ed398ce617478ecf2a34ff93e2bbf1e11285fbe8bcc639e07f0e37834086d7c9fb205f3788

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\phcjrkhjbp.bin

Filesize
584B

MD5
5a55772b9d5705ab5cd475791aaaf326

SHA1
748f2043b1822c8a9f17d4a1b444402b790ffd19

SHA256
9f96a8d9c7b014187ff7e68502018d803011797c6dfcad01531a122473dc37b0

SHA512
800bb0f2143f1f97911b3c4395a17f02b68e4563980e74b1d35aeb56afd1e3b91d081b0d5af05a1b6902039a1c73b37449fc44250a90fbbee8b008f2b96daad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pkifnicf.xl

Filesize
600B

MD5
e2bc0137956ad50aba8a6de78d288bc1

SHA1
570d917fc485896db77d2bbac6823dea358e3e82

SHA256
bbcdc92a9eedd9f3f6bcc3e5300c7fcf0f3c637b398ff48002920692ff709d4d

SHA512
24b59425d6ab031417ff3ebe144cf9c00e9e6bd0477110cd0513342140294e4862fffb8d23d3392ccef0ef75b906112b5663f94691be1fbb18de8705082c9b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\qbfovgn.docx

Filesize
530B

MD5
d16d62e47920fbca44d68d49a3f498e7

SHA1
b2d13343bb324b570e6b21b1da8ddd6e4be51443

SHA256
1f13dcdcb88cf9c17a2fe2b530c45286226adf44a368894b3da7782f5b006a05

SHA512
12a181814092820eee13c03b5b2182b3fdc6378f559f3bcf21f41835f99f47a469020ce421081ec34dea945cefeb35b23eb3a21a6d9615ef1bce4255b480ce9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\uogxhqjurf.unj

Filesize
879KB

MD5
ba3227a6a7e9aae129c0fb82bb511b95

SHA1
26985630ffdb7ca1caf18b4dd4edbb52a4c840be

SHA256
829d9797e898db11878d79b7588f1efb271c08761a0fbedc00c2ddca1ca1a762

SHA512
ee2efe5e06d729c37dda6e6d2d9057008a73a3de7e01698da15f70e606402276897b119b7f370a0ea3afac4ee6e364f423bdde954be210a47978f8c7391622ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiawlvwkw.ppt

Filesize
611B

MD5
874fec7608750f576a5c02061faa516e

SHA1
73b0081e470cbafc021b450514b1d29a5b240b12

SHA256
4c64c814fada340bf06af521a036a95aef0c8353fcd7cbf5ccf9df78e1943e21

SHA512
5ef4b3aff4144160a5664f321f8817a1bd4ee05b7967fb37878d776a6f2089422f6df11f91c3bfec6dc47e6effb361320717e47e6c306151a1aa7b2d26e26846

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xsjduanaek.pdf

Filesize
614B

MD5
dc5f6bf3e30c74e8b7825d11c2d65fe6

SHA1
fc1202386ae5a08614d579af53255c51e179fded

SHA256
022dd133d94d4ca79aac1d3f6ae3b01f262b0eddc650f3c9b2d9e5c605326869

SHA512
00e4083890cd7b0f0decfdbfb79aae8bdeef484c630dde1d28f8c9151733ccf4bfb32f44fc7ef95a3080d2e3a907a861c65e4c5b3628fa8af589fa54328d23c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xsrglhc.icm

Filesize
560B

MD5
f127a97e7c9c6c248c0d1d35cf3e9a3e

SHA1
d62b6182baa6fb71317a03095f5396ae2b3cc62f

SHA256
3243d6e21b3b3a33dd7692cbd2f7f7683aa614d46d460138cdc9066cbbdab082

SHA512
c41d80a3643211c3b635d796e671ab4ef8430618e2b7b1ffb38620aeaaf48f3beb67dc5689c7c333ca1f77d62b9c2f0db883e655dd7e2ba37861e5aece223c55

Download Submit
C:\Users\Admin\AppData\Local\Temp\isoyridcvmeukdyzhgk

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\puachd.msc

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Filesize
44KB

MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
memory/1304-149-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1304-156-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1304-163-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1472-153-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1472-158-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1472-157-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1896-160-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1896-162-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1896-164-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2400-139-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-170-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-134-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-138-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-137-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-125-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2400-133-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-126-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-129-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-128-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-165-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-140-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-123-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-173-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-174-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-175-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2400-179-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2400-178-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2400-181-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-183-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-182-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download
memory/2400-185-0x0000000000810000-0x0000000000EA1000-memory.dmp

Filesize
6.6MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads