remcos | c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08/02/2025, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
Size 372KB
Sample250208-e1d4dawpdm
SHA256 c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41
MD5 c4195aa623f8eeddc85c52c6eed94237
SHA1 1caf5144268c47d69a44dc4dd0254a2fdd520a6c
SHA512 2110f3d31b8c1be9622a13451fea08713dace2467793267aa8341c49a1e1c2d15efed2a6478ce558abb6e2d9428a25e942538027e70b00437f8e8bd22580aafe
SSDEEP 6144:tedgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:t0qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos tino discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

TINo

185.140.53.140:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
true
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-5S9O07
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Modifies WinLogon for persistence 2 TTPs 40 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Executes dropped EXE 64 IoCs

pid	Process
2892	hab.exe
2772	hab.exe
2680	remcos.exe
1504	remcos.exe
2644	hab.exe
1048	hab.exe
3040	remcos.exe
848	remcos.exe
1964	hab.exe
760	hab.exe
2388	remcos.exe
2216	remcos.exe
2460	hab.exe
1288	hab.exe
1740	remcos.exe
2000	remcos.exe
2280	hab.exe
1652	hab.exe
2744	remcos.exe
2852	remcos.exe
2904	hab.exe
2788	hab.exe
2856	remcos.exe
1144	remcos.exe
2272	hab.exe
2676	hab.exe
2420	remcos.exe
3016	remcos.exe
2972	hab.exe
2472	hab.exe
1836	remcos.exe
2064	remcos.exe
2376	hab.exe
2088	hab.exe
2560	remcos.exe
820	remcos.exe
2460	hab.exe
1020	hab.exe
2916	remcos.exe
1072	remcos.exe
940	hab.exe
2280	hab.exe
2300	remcos.exe
1596	remcos.exe
2820	hab.exe
2904	hab.exe
2116	remcos.exe
2784	remcos.exe
2776	hab.exe
2732	hab.exe
2588	remcos.exe
2248	remcos.exe
2956	hab.exe
2968	hab.exe
1988	remcos.exe
2544	remcos.exe
2168	hab.exe
316	hab.exe
1084	remcos.exe
2204	remcos.exe
948	hab.exe
3064	hab.exe
1736	remcos.exe
1740	remcos.exe

Loads dropped DLL 64 IoCs

pid	Process
2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2892	hab.exe
2712	cmd.exe
2712	cmd.exe
1504	remcos.exe
1504	remcos.exe
2644	hab.exe
2952	cmd.exe
2952	cmd.exe
848	remcos.exe
848	remcos.exe
1964	hab.exe
2184	cmd.exe
2184	cmd.exe
2216	remcos.exe
2216	remcos.exe
2460	hab.exe
1620	cmd.exe
1620	cmd.exe
2000	remcos.exe
2000	remcos.exe
2280	hab.exe
1608	cmd.exe
1608	cmd.exe
2852	remcos.exe
2852	remcos.exe
2904	hab.exe
2772	cmd.exe
2772	cmd.exe
1144	remcos.exe
1144	remcos.exe
2272	hab.exe
1624	cmd.exe
1624	cmd.exe
3016	remcos.exe
3016	remcos.exe
2972	hab.exe
2544	cmd.exe
2544	cmd.exe
2064	remcos.exe
2064	remcos.exe
2376	hab.exe
2388	cmd.exe
2388	cmd.exe
820	remcos.exe
820	remcos.exe
2460	hab.exe
2004	cmd.exe
2004	cmd.exe
1072	remcos.exe
1072	remcos.exe
940	hab.exe
1508	cmd.exe
1508	cmd.exe
1596	remcos.exe
1596	remcos.exe
2820	hab.exe
3052	cmd.exe
3052	cmd.exe
2784	remcos.exe
2784	remcos.exe
2776	hab.exe
2448	cmd.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe

Modifies WinLogon 2 TTPs 40 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 572 set thread context of 2148	572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	29
PID 2892 set thread context of 2772	2892	hab.exe	31
PID 2680 set thread context of 1504	2680	remcos.exe	36
PID 2644 set thread context of 1048	2644	hab.exe	38
PID 3040 set thread context of 848	3040	remcos.exe	43
PID 1964 set thread context of 760	1964	hab.exe	45
PID 2388 set thread context of 2216	2388	remcos.exe	50
PID 2460 set thread context of 1288	2460	hab.exe	52
PID 1740 set thread context of 2000	1740	remcos.exe	57
PID 2280 set thread context of 1652	2280	hab.exe	59
PID 2744 set thread context of 2852	2744	remcos.exe	64
PID 2904 set thread context of 2788	2904	hab.exe	66
PID 2856 set thread context of 1144	2856	remcos.exe	71
PID 2272 set thread context of 2676	2272	hab.exe	73
PID 2420 set thread context of 3016	2420	remcos.exe	78
PID 2972 set thread context of 2472	2972	hab.exe	80
PID 1836 set thread context of 2064	1836	remcos.exe	85
PID 2376 set thread context of 2088	2376	hab.exe	87
PID 2560 set thread context of 820	2560	remcos.exe	92
PID 2460 set thread context of 1020	2460	hab.exe	94
PID 2916 set thread context of 1072	2916	remcos.exe	99
PID 940 set thread context of 2280	940	hab.exe	101
PID 2300 set thread context of 1596	2300	remcos.exe	106
PID 2820 set thread context of 2904	2820	hab.exe	108
PID 2116 set thread context of 2784	2116	remcos.exe	113
PID 2776 set thread context of 2732	2776	hab.exe	115
PID 2588 set thread context of 2248	2588	remcos.exe	120
PID 2956 set thread context of 2968	2956	hab.exe	122
PID 1988 set thread context of 2544	1988	remcos.exe	127
PID 2168 set thread context of 316	2168	hab.exe	129
PID 1084 set thread context of 2204	1084	remcos.exe	134
PID 948 set thread context of 3064	948	hab.exe	136
PID 1736 set thread context of 1740	1736	remcos.exe	141
PID 2144 set thread context of 2500	2144	hab.exe	143
PID 2540 set thread context of 2300	2540	remcos.exe	148
PID 2940 set thread context of 572	2940	hab.exe	150
PID 2736 set thread context of 2728	2736	remcos.exe	155
PID 2740 set thread context of 952	2740	hab.exe	157
PID 1928 set thread context of 3000	1928	remcos.exe	162
PID 1472 set thread context of 1976	1472	hab.exe	164
PID 2056 set thread context of 1328	2056	remcos.exe	169
PID 2580 set thread context of 2376	2580	hab.exe	171
PID 2160 set thread context of 1756	2160	remcos.exe	176
PID 2204 set thread context of 2040	2204	hab.exe	178
PID 1300 set thread context of 1800	1300	remcos.exe	183
PID 1072 set thread context of 2416	1072	hab.exe	185
PID 1428 set thread context of 2792	1428	remcos.exe	190
PID 2484 set thread context of 2332	2484	hab.exe	192
PID 2464 set thread context of 2828	2464	remcos.exe	197
PID 1144 set thread context of 2696	1144	hab.exe	199
PID 1672 set thread context of 2652	1672	remcos.exe	204
PID 2760 set thread context of 3000	2760	hab.exe	206
PID 1964 set thread context of 2976	1964	remcos.exe	211
PID 2424 set thread context of 2276	2424	hab.exe	213
PID 1536 set thread context of 2372	1536	remcos.exe	218
PID 2164 set thread context of 1520	2164	hab.exe	220
PID 2016 set thread context of 1064	2016	remcos.exe	225
PID 2000 set thread context of 1728	2000	hab.exe	227
PID 2536 set thread context of 1816	2536	remcos.exe	232
PID 2912 set thread context of 696	2912	hab.exe	234
PID 1384 set thread context of 2868	1384	remcos.exe	239
PID 3044 set thread context of 2464	3044	hab.exe	241
PID 1708 set thread context of 2296	1708	remcos.exe	246
PID 2244 set thread context of 2044	2244	hab.exe	248

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2892	hab.exe
2892	hab.exe
2772	hab.exe
2772	hab.exe
2680	remcos.exe
2680	remcos.exe
1504	remcos.exe
1504	remcos.exe
2644	hab.exe
2644	hab.exe
1048	hab.exe
1048	hab.exe
3040	remcos.exe
3040	remcos.exe
848	remcos.exe
848	remcos.exe
1964	hab.exe
1964	hab.exe
760	hab.exe
760	hab.exe
2388	remcos.exe
2388	remcos.exe
2216	remcos.exe
2216	remcos.exe
2460	hab.exe
2460	hab.exe
1288	hab.exe
1288	hab.exe
1740	remcos.exe
1740	remcos.exe
2000	remcos.exe
2000	remcos.exe
2280	hab.exe
2280	hab.exe
1652	hab.exe
1652	hab.exe
2744	remcos.exe
2744	remcos.exe
2852	remcos.exe
2852	remcos.exe
2904	hab.exe
2904	hab.exe
2788	hab.exe
2788	hab.exe
2856	remcos.exe
2856	remcos.exe
1144	remcos.exe
1144	remcos.exe
2272	hab.exe
2272	hab.exe
2676	hab.exe
2676	hab.exe
2420	remcos.exe
2420	remcos.exe
3016	remcos.exe
3016	remcos.exe
2972	hab.exe
2972	hab.exe
2472	hab.exe
2472	hab.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2892	hab.exe
2892	hab.exe
2772	hab.exe
2772	hab.exe
2680	remcos.exe
2680	remcos.exe
1504	remcos.exe
1504	remcos.exe
2644	hab.exe
2644	hab.exe
1048	hab.exe
1048	hab.exe
3040	remcos.exe
3040	remcos.exe
848	remcos.exe
848	remcos.exe
1964	hab.exe
1964	hab.exe
760	hab.exe
760	hab.exe
2388	remcos.exe
2388	remcos.exe
2216	remcos.exe
2216	remcos.exe
2460	hab.exe
2460	hab.exe
1288	hab.exe
1288	hab.exe
1740	remcos.exe
1740	remcos.exe
2000	remcos.exe
2000	remcos.exe
2280	hab.exe
2280	hab.exe
1652	hab.exe
1652	hab.exe
2744	remcos.exe
2744	remcos.exe
2852	remcos.exe
2852	remcos.exe
2904	hab.exe
2904	hab.exe
2788	hab.exe
2788	hab.exe
2856	remcos.exe
2856	remcos.exe
1144	remcos.exe
1144	remcos.exe
2272	hab.exe
2272	hab.exe
2676	hab.exe
2676	hab.exe
2420	remcos.exe
2420	remcos.exe
3016	remcos.exe
3016	remcos.exe
2972	hab.exe
2972	hab.exe
2472	hab.exe
2472	hab.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
2892	hab.exe
2772	hab.exe
2680	remcos.exe
1504	remcos.exe
2644	hab.exe
1048	hab.exe
3040	remcos.exe
848	remcos.exe
1964	hab.exe
760	hab.exe
2388	remcos.exe
2216	remcos.exe
2460	hab.exe
1288	hab.exe
1740	remcos.exe
2000	remcos.exe
2280	hab.exe
1652	hab.exe
2744	remcos.exe
2852	remcos.exe
2904	hab.exe
2788	hab.exe
2856	remcos.exe
1144	remcos.exe
2272	hab.exe
2676	hab.exe
2420	remcos.exe
3016	remcos.exe
2972	hab.exe
2472	hab.exe
1836	remcos.exe
2064	remcos.exe
2376	hab.exe
2088	hab.exe
2560	remcos.exe
820	remcos.exe
2460	hab.exe
1020	hab.exe
2916	remcos.exe
1072	remcos.exe
940	hab.exe
2280	hab.exe
2300	remcos.exe
1596	remcos.exe
2820	hab.exe
2904	hab.exe
2116	remcos.exe
2784	remcos.exe
2776	hab.exe
2732	hab.exe
2588	remcos.exe
2248	remcos.exe
2956	hab.exe
2968	hab.exe
1988	remcos.exe
2544	remcos.exe
2168	hab.exe
316	hab.exe
1084	remcos.exe
2204	remcos.exe
948	hab.exe
3064	hab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 2148	572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	29
PID 572 wrote to memory of 2148	572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	29
PID 572 wrote to memory of 2148	572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	29
PID 572 wrote to memory of 2148	572	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	29
PID 2148 wrote to memory of 2892	2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	30
PID 2148 wrote to memory of 2892	2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	30
PID 2148 wrote to memory of 2892	2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	30
PID 2148 wrote to memory of 2892	2148	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	30
PID 2892 wrote to memory of 2772	2892	hab.exe	31
PID 2892 wrote to memory of 2772	2892	hab.exe	31
PID 2892 wrote to memory of 2772	2892	hab.exe	31
PID 2892 wrote to memory of 2772	2892	hab.exe	31
PID 2772 wrote to memory of 2688	2772	hab.exe	32
PID 2772 wrote to memory of 2688	2772	hab.exe	32
PID 2772 wrote to memory of 2688	2772	hab.exe	32
PID 2772 wrote to memory of 2688	2772	hab.exe	32
PID 2688 wrote to memory of 2712	2688	WScript.exe	33
PID 2688 wrote to memory of 2712	2688	WScript.exe	33
PID 2688 wrote to memory of 2712	2688	WScript.exe	33
PID 2688 wrote to memory of 2712	2688	WScript.exe	33
PID 2712 wrote to memory of 2680	2712	cmd.exe	35
PID 2712 wrote to memory of 2680	2712	cmd.exe	35
PID 2712 wrote to memory of 2680	2712	cmd.exe	35
PID 2712 wrote to memory of 2680	2712	cmd.exe	35
PID 2680 wrote to memory of 1504	2680	remcos.exe	36
PID 2680 wrote to memory of 1504	2680	remcos.exe	36
PID 2680 wrote to memory of 1504	2680	remcos.exe	36
PID 2680 wrote to memory of 1504	2680	remcos.exe	36
PID 1504 wrote to memory of 2644	1504	remcos.exe	37
PID 1504 wrote to memory of 2644	1504	remcos.exe	37
PID 1504 wrote to memory of 2644	1504	remcos.exe	37
PID 1504 wrote to memory of 2644	1504	remcos.exe	37
PID 2644 wrote to memory of 1048	2644	hab.exe	38
PID 2644 wrote to memory of 1048	2644	hab.exe	38
PID 2644 wrote to memory of 1048	2644	hab.exe	38
PID 2644 wrote to memory of 1048	2644	hab.exe	38
PID 1048 wrote to memory of 2956	1048	hab.exe	39
PID 1048 wrote to memory of 2956	1048	hab.exe	39
PID 1048 wrote to memory of 2956	1048	hab.exe	39
PID 1048 wrote to memory of 2956	1048	hab.exe	39
PID 2956 wrote to memory of 2952	2956	WScript.exe	40
PID 2956 wrote to memory of 2952	2956	WScript.exe	40
PID 2956 wrote to memory of 2952	2956	WScript.exe	40
PID 2956 wrote to memory of 2952	2956	WScript.exe	40
PID 2952 wrote to memory of 3040	2952	cmd.exe	42
PID 2952 wrote to memory of 3040	2952	cmd.exe	42
PID 2952 wrote to memory of 3040	2952	cmd.exe	42
PID 2952 wrote to memory of 3040	2952	cmd.exe	42
PID 3040 wrote to memory of 848	3040	remcos.exe	43
PID 3040 wrote to memory of 848	3040	remcos.exe	43
PID 3040 wrote to memory of 848	3040	remcos.exe	43
PID 3040 wrote to memory of 848	3040	remcos.exe	43
PID 848 wrote to memory of 1964	848	remcos.exe	44
PID 848 wrote to memory of 1964	848	remcos.exe	44
PID 848 wrote to memory of 1964	848	remcos.exe	44
PID 848 wrote to memory of 1964	848	remcos.exe	44
PID 1964 wrote to memory of 760	1964	hab.exe	45
PID 1964 wrote to memory of 760	1964	hab.exe	45
PID 1964 wrote to memory of 760	1964	hab.exe	45
PID 1964 wrote to memory of 760	1964	hab.exe	45
PID 760 wrote to memory of 2840	760	hab.exe	46
PID 760 wrote to memory of 2840	760	hab.exe	46
PID 760 wrote to memory of 2840	760	hab.exe	46
PID 760 wrote to memory of 2840	760	hab.exe	46

C:\Users\Admin\AppData\Local\Temp\c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
"C:\Users\Admin\AppData\Local\Temp\c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572
- C:\Users\Admin\AppData\Local\Temp\c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
  "C:\Users\Admin\AppData\Local\Temp\c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\hab.exe
    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\hab.exe
      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Modifies WinLogon
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2688
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        10⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        12⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        16⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        18⤵
        Loads dropped DLL
        
        PID:2184
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2388
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        22⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        23⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        24⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        28⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:1088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        30⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        33⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        34⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        35⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        36⤵
        Loads dropped DLL
        
        PID:2772
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        38⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        39⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        40⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2676
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        42⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        44⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        45⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        46⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        47⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        48⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1836
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        50⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        51⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        52⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        53⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        54⤵
        Loads dropped DLL
        
        PID:2388
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        56⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        57⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        58⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        59⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        60⤵
        Loads dropped DLL
        
        PID:2004
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        62⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        63⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        64⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        65⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        66⤵
        Loads dropped DLL
        
        PID:1508
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        67⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2300
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        68⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        69⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        70⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        71⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        72⤵
        Loads dropped DLL
        
        PID:3052
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        73⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        74⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        75⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        76⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        77⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        78⤵
        Loads dropped DLL
        
        PID:2448
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        79⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        80⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        81⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        82⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of SetWindowsHookEx
        
        PID:2968
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        83⤵
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        84⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        85⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1988
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        86⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        87⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        88⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:316
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        89⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:1756
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        91⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1084
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        92⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        93⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        94⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        95⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        96⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        97⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1736
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        98⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        99⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        100⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2500
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        102⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        103⤵
        Suspicious use of SetThreadContext
        
        PID:2540
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        104⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        105⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        106⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:572
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        107⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        108⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        109⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2736
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        111⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        112⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:952
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        113⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        114⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        115⤵
        Suspicious use of SetThreadContext
        
        PID:1928
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        116⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        117⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        118⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:1976
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        120⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        121⤵
        Suspicious use of SetThreadContext
        
        PID:2056
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        122⤵
        Drops file in Windows directory
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        123⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        124⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2376
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        125⤵
        
        PID:316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        126⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        127⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2160
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        128⤵
        Drops file in Windows directory
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        129⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        130⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2040
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        131⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        132⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        133⤵
        Suspicious use of SetThreadContext
        
        PID:1300
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        134⤵
        Drops file in Windows directory
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        135⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        136⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2416
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        137⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        138⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        139⤵
        Suspicious use of SetThreadContext
        
        PID:1428
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        141⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        142⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2332
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        143⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        144⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        145⤵
        Suspicious use of SetThreadContext
        
        PID:2464
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        146⤵
        Drops file in Windows directory
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        147⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        148⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2696
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        149⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        150⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        151⤵
        Suspicious use of SetThreadContext
        
        PID:1672
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        152⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        153⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        154⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:3000
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        156⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        157⤵
        Suspicious use of SetThreadContext
        
        PID:1964
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        158⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        159⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        160⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2276
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        161⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        163⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1536
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        164⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        165⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        166⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:1520
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        167⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        168⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        169⤵
        Suspicious use of SetThreadContext
        
        PID:2016
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        170⤵
        Drops file in Windows directory
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        171⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        172⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:1728
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        173⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        175⤵
        Suspicious use of SetThreadContext
        
        PID:2536
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        176⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        177⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        178⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        
        PID:696
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        179⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        180⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        181⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1384
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        182⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        183⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        184⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2464
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        185⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        186⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        187⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1708
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        188⤵
        Drops file in Windows directory
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        189⤵
        Suspicious use of SetThreadContext
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        190⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        191⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        192⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        193⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        194⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        195⤵
        Adds Run key to start application
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        196⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2232
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        199⤵
        Drops file in Windows directory
        
        PID:2600
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        200⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        201⤵
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        202⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        
        PID:2068
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        204⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        205⤵
        Drops file in Windows directory
        
        PID:552
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        206⤵
        Drops file in Windows directory
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        207⤵
        Adds Run key to start application
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        208⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:1620
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        210⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        211⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        212⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        213⤵
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        214⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        215⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        216⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        218⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        219⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        220⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        221⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        222⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        223⤵
        Drops file in Windows directory
        
        PID:2680
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        224⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        225⤵
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        226⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        
        PID:584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        227⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        228⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        229⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        230⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        231⤵
        Adds Run key to start application
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        232⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2572
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        233⤵
        
        PID:632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        234⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        235⤵
        Drops file in Windows directory
        
        PID:2544
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        236⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        237⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        238⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        
        PID:2200
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        239⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        240⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        241⤵
        Drops file in Windows directory
        
        PID:1056
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        242⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        243⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        244⤵
        
        PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 3689012eb16256ea1d2d8f6e6b735af74b67749556b5e893dcd477f2f5505e84
MD5 1d6ff9cc545b963a8aaaff5251df446e
SHA1 85428b43e390152524c678492501b8f8c124cb95
SHA512 5a8e0b00f613a36f4634e1d45d81ba3325627a51c34e89447d86c3c998d0078282f1bd1dc83579372e1ee1879005d7769d07e056723e2b2809dce3d7b5937ce1
SSDEEP 6144:tDdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:tpqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 deba3e4529398240107087fcd885394b66a9fd6f046c6fd0287920345eb75766
MD5 ffae18e526a0e593bd492ea864e54139
SHA1 bd05a01a62e3923fbb7c3a6dbec5ffc6f8ba382a
SHA512 9ce725aa77d445ea8b1b7a441ff7f7c500bf1b9435a78e0d16531b5bdd0032eddae6119ca7ca9bc33f66095e4afaef4acd692547a499f9a1a1b5c82c00cd6b0c
SSDEEP 6144:t/dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiW:tlqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 dae2e59d29e61282037ca2714ebc11742fc60507fe464092b1bb06eb75f5f5ef
MD5 5b90980303548c52dedcafa249f16ad8
SHA1 6b2c725ed4b0bacad02f52cc160450a1d02d7ec4
SHA512 88da42df063f938f06c43b8ff2f2798395af41103d9b363eb47cb73cce57d6b6beb09d417eeeb5922954768767b9272cc5607d0cef612dbc147f3db8bf44e937
SSDEEP 6144:t8dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhim:t2qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 bf06d23d2d5f2ed6d52d0a3b9e0799af2768dcffbfd17043966e4ac56219eb78
MD5 fced5e80ca7da337473a53f9b75a885b
SHA1 2c1cbf5150b44e65ecf1e7fa3de4e5cdd1928c48
SHA512 b3828b3aec6cf6a8299888d629fb0954c9d5be8519781f5efe7a31a0ed48743cfbc81e6432463c8194049629eba205c6712048a8e291bd71340f49a78adc5adb
SSDEEP 6144:tIdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi2:tSqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 6d1d1f7a86583a7bb0238aacb71fe7e534e6b7d50c2e2b50de65a6ceaa8073db
MD5 ffc2c6cdc86fb97436d4e81bb512ab32
SHA1 aecbe631a14849730e2a429e9076d7846bec3724
SHA512 1265fd5b0abffddaad0f8fcb15371c4a783ed112486f0aa1f0f02a86aab08569b4fe08682f81cc3f6c7fab5a739ceb13d28672453b91ed26075ac4be6704553e
SSDEEP 6144:tndgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhim:tdqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 de3df1b823636e29d882dc73b743a657646eaa3a1e19c7aa6a92aa31fce1359b
MD5 eeaf00f004e6f115dc12912d59b4349b
SHA1 b66cf603ed18e53ee4684a549f8558c1c6c5db2d
SHA512 42107a2890fb112f4f2aadf1ecbe4b047735ef0e6de8ab9a671627bc6da7874454a2bb49ccf9e4a5fbed50a745b1c023d2a90af81d1d9c35de61c04b647b61c1
SSDEEP 6144:tGdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhie:tMqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 dfa335fe51b0720f753476139567b1c989b9b50247e762c4cc704bdc2167db78
MD5 a0b0b3f447e10d9216505b0539ca1ee6
SHA1 1bac2cf1e487f2f9fc4fbd421b76d199475730d1
SHA512 117f6eb8665ecd76c800ab3c2110251efb1a284fedeab995175acfd46e1f5855122219a918384f89892465f382d298f894fa6160d34bd0ac85e74015b5cab4a4
SSDEEP 6144:tZdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi+:t7qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 1d2cfdf1260fd3734f0e2e2e7b48308e2d88a64a41be7c7e4ccd7639239ff227
MD5 f11997be38b0d0518fa2116532ce8541
SHA1 0c067991378cf96d21edb6e5cc1390c1a5fe99de
SHA512 9cc4febb46929ee496159e8fd3887d903d341f88cf7b5130af75f6b9de681c7133ed8fdbe70c91cfaf490ef7e009a451df840828fe0a7fed2a28edb9a8bb557a
SSDEEP 6144:t8dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi+:t2qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 34d185d2420994d47b0cdb8f673aba5974a81aaa7c0202b75b7fe49fe4a9212f
MD5 d1287ddb696e285e536f304b8d3f3609
SHA1 45f4412e1378c64cc1497a6827b898145a12935b
SHA512 264ccf2947f3f7be9591722149eb4b15944f8befa285406e1229ec9ebede23f8b40d88dd7ad40f49697d76369705a7db5cb54996764d05d75a241bbdde161df5
SSDEEP 6144:tgdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi+:t6qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 2b3b73ddfbca87cea8071d406a2e7209f929bc0a957a417dbf7dfc13f48238c6
MD5 9a2db9a5cbbac3a2120657a73f8626b9
SHA1 b0f3d67893b65b2ea7c63dfb04b806188b1a8d50
SHA512 de23363956f47e5b6365a2396a1046e667b9ee90e6ec6641d90cdb5b1a9bfc4b4ae4342f82c8ba713932c3f9f461f826b27bbacd8d5c7c8b9165fd4c4331514a
SSDEEP 6144:tNdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi6:tfqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 06641f86245cc0d502d640b62a1c80a96d41d1d4a1105633eaa6b1ad77c4d37b
MD5 b7d085b11683b05ba12e7d894c6d039e
SHA1 f4d8916121fd0e4a131f73f004c1b0b7eeabb589
SHA512 34a8ac2cef5d4c52d2cdc71f0c72ab434473769d1151981445c8424a750f4b34db9259b828633259d755ca42b96886ff36a61c7e6bed8ef9026364d9ca8490f4
SSDEEP 6144:tJdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:trqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 04c0cf6cd4ffd82def776a84e470823863a7380aa2b36ecb159620524ddc9f2e
MD5 c11f01ee53aadf5d4b31ba29a621004c
SHA1 ca1d866a7e6b2d454f67c83629abe19edc835ce1
SHA512 eae55da15245e3f0f678fdab0c56a474de9c9ebbc91dc111c61632a60cd7560fc50d60d7d3d0574c7b7d1c4292cc6d866a2a06eb40c0140b5286a39b4a000c92
SSDEEP 6144:tidgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiq:tIqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 53b33d2e7f6226bb41d0ae988f82b5d72b8e4d3a61ac6305683cd67fb7378625
MD5 968c4bdff6476bdd4a4b47a4c96aae5f
SHA1 abe4ad20cd006afc9ed74b0b92a6c4d7a2281ebb
SHA512 3aade9ee571c44f399971d52272aa1a1e9d2f40a1c523b451b9eef0a3561e626cefe87365efe6e834ea7a04fa40a85ab3956c77a481fe45efbf47be56b677587
SSDEEP 6144:tHdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:t9qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 d6649b26ab45e7960a671e56820b7f397bc31f7bf5d0b12eca9805dd356fea83
MD5 33c40767f4ac20d8944d27b0bb48e82e
SHA1 7955c0f908d464e420b8108cc40344a6946a6140
SHA512 ca304e6056713bbc2b83ec6f457d6955bc8518ed5226c7238d57002e38d2ec15216953fa96a389e29135528c4ccc6749dbbe6815d9755d88c69d886946490741
SSDEEP 6144:t0dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:t+qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 79fee51e24bb327209ad796e4fc67dfd609918aff89de677e0d737bdd4ab124b
MD5 276c2d1ccd94326cfd8247e26e1afd75
SHA1 44cc0d62310ea954dd293bea159358881c4cac2e
SHA512 e7fde9a88570c4fb8f80306a960d95239c8b53ef8a2f98f856272689c494af74946099d29ae906dc87a13a8926c1c4c5cef83fd1d7bad130523858de9d847951
SSDEEP 6144:tVdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:t3qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 dec08d25c0459aadd23f54358482a45acd78dd259f6fd6a6dbfaedcf1c8c3ee2
MD5 642325ea5ed592c77c897515cf32860a
SHA1 6af144076a845c0ad11b91f4aa9d4de98c2ed530
SHA512 5d9e8d7a01dfdac388009afe002cd8350c44d4765bc59ca35ae9c28645cb6467835ba7d5421f0a9c74d5881a281a3146ce84abc6a87d5e578d2c3a54f624aa02
SSDEEP 6144:tZdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiK:t7qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 f174ad8e1e90a147c492b0a4b031d57ec48f627f1775fa227e38ab4941d371da
MD5 a7f5da2805317129f63f5d1861fe83c5
SHA1 5cdb76040424d7f62e5ce4e688dad3dea5ba4b31
SHA512 39917f8acd9dc61562c4cf33d404f4ead86b03987791e58b2ad3e574e54175d7e1b8765146364b9fd1e6246f6e57ce5c1febe2f717d7804aae09deb771790c7d
SSDEEP 6144:tAdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:taqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 d4539a499a94c789549e0ad8b2f74a6b3933d6f79b3e48632ad3e82d1c723de9
MD5 7683402917d0898a0575c94484cc98fe
SHA1 8aa13607ed980a38818ddc6bc16637dc404968fb
SHA512 184b0a4b3a68d443e3114e0772ae5231d4566181c1a32159d021238708f1b763f81d527707e9da8b94ab91117217240f56e5b6a9d78a454f141dc3c27a882255
SSDEEP 6144:tTdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi6:t5qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 21d11c27ac25af83d66729281e72a507e50c3291618f38a584108221251f128d
MD5 1a6b81a82298e96dd1449f7327c9c0b3
SHA1 4b77fa2cf4e0159b2c4cfc0b4dd3fcdd873127f2
SHA512 cb0f6686c54b0298c5f50dceb857a09119e4cd5e1da5d239897e72a99f7658d8c67b604389ebb00d72c283a3b0b28ca3e3a8c230809691ff301d4db059df6ea8
SSDEEP 6144:tmdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhii:tsqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 4a06ef22f822841455f986f3e488b2cea46f1a39a11a6311ff1bc92fa945b366
MD5 4c254edc33d469ca76f044824bd20227
SHA1 ad8e2e1251af9b8ef58993cc0150dfade1087d2b
SHA512 12aae2dce33d8ef0808d716b005a899d84dc149977fca643f4c4653f96ff3021271ca6e62723be7c4d57a9079c7db6cea1780e73830ba6cc203e3d224e5f510b
SSDEEP 6144:tldgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiq:tHqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 0aa1cd2f992698b327914a7bec23effe010277e40455e3c614f7f70656b97f0a
MD5 383e0aa92adfe983a14c0909962bf626
SHA1 2bdc4a763023e03f7a972e0e4f286ddc94b5234c
SHA512 61d6a4a7b626f99133687e8094274b612f79b7d70a5fa7ef201617cda5268081646d0e1012eb8dad7c7fb00bfd09d22e9c2619d2b0b6c9fdee673aeb26dd93cc
SSDEEP 6144:tldgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:tHqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 0142efde1a5ebaac18ea16d97b409a4b96fd3bdacce9d7064ae12707503e98c5
MD5 c7affc0012ef03e91d936eb013116566
SHA1 2fb100c307382a441dcd18ccdbe78a9bc6897603
SHA512 dc2eb7fae3195f74f7569220769096a91128fbe6fffbd4b20720dd79b3f74777802ae98bbe435e934e93e269d91e15d5e49f8abd28398e23768e0e9ed312456b
SSDEEP 6144:tidgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:tIqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 6693b2a79542ce7d62fcc7040d5e8415a46334b8ac19ab889fa2398a7f847ed5
MD5 3fa9a4f8dc35ac67f01fe5499fdc8e89
SHA1 570fa552748cc9d84484809b5f906f5038c308fd
SHA512 4c3503c9e76548ab13dfbf523d5468305488bd5942cbd889b88aa23cc4631a6fab8d2b2382f47db18bc41471a9887ce131b4d1254dce52133fb58fe226f3fb88
SSDEEP 6144:tndgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:tdqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 5af09381e4d8c4c6348f7b08dc8cb2fd07fcb67e8bd4a65791c8da7d2730c2bb
MD5 69ba486646238e709a20620c78b9ab2a
SHA1 a4b4b46924f915ab6eb4b05fa5e8d3b1f248855f
SHA512 a3d1876e9c45a67ede69eff54db580fe526e14156396c2bab0b2e0d87686ffbb78289351f8e5ad57b2ddf9e70812ab6770ad02b57ef4292b6e3451b3889a0539
SSDEEP 6144:tgdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiK:t6qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 0cf0a7636311ccfa1365a60c19f437228e6d2c225724e168fc4038dee34c60ac
MD5 3b66a82f63ed0f8934eeed4082d96e79
SHA1 e95f6beccbbd34f29a1a28fdcfad43e5752d2473
SHA512 ed0e9f7423d453d2481764cffc131ddecc6308025b0994733e28be449ed9b937095232222e7ab5ae579d4df64797ed3dd3a81f66bfedc8aa84011e042c6ce195
SSDEEP 6144:t5dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:tbqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 491b1db716de2ee012bc62f22cdf2dc67c7fef15334a980e51755769c4cc89e8
MD5 83c1b4d9c302053bc8cc143c8200e18d
SHA1 3db83e534b50ef299f459def04c135fb88c064e8
SHA512 af0eff0e485a621e762dfc6186ac1d4f8463a58ffac92e1ea718d6f55a132888c7e9b41d6543e4c9e6fd389b96de2d4fb5b13641c5d57b3f2d5fbda3ff567f65
SSDEEP 6144:tRdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi6:tjqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 2bf39787930b881e72b52738ae2714046f73ab837da0c963809c98ac2eacb143
MD5 c2e5c91e7af4661fd0df60f5b831928a
SHA1 f130a041b5913985bd02ee3dd0c7ed86bb0604d8
SHA512 2d3bc81d20bdd47e736eb5a821db2638ac6cca2dfcf60ce81d2d8f301d8bb2b7e024b5d90d601ff07b3d0ffeeb6f599b4d566e946b6e6a44bfd7a4f908a822b2
SSDEEP 6144:tYdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:tiqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 11a7138f31a6115f20fe06a7892a9e8bc4a2fb90b8e69da507cd96158badbc85
MD5 ad05b4dde6ef1929ef3bf6ac61a06a79
SHA1 a3b6e3fef9ccdec3bfe46e8bd1ed8c73a63bc8f7
SHA512 fef1c848e69073a6a1552b30313b6c0f43e8d44ec43de30e2e5225beb903305848eafc73b99b2d641a916437bc8480f8e50e19108b81b4c7c1cc1c5dd9f4defc
SSDEEP 6144:tndgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiq:tdqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 9eac5164744494fad37d728da22c447a58ff0864d29050a6271d1acfff0c7452
MD5 d5ff66c4edd0154dbe219bf81fdbfe2c
SHA1 8f15269dd78a65413f579fe032289ffc80416658
SHA512 e7a26f7a6ffd00cc2bba77e6f9e4773822e23756b698db59e3e9c570d3bb088bf02a902f3c165ac27eefc633898a93c33568a9c9eefc10a614e3fa3d1fbc9766
SSDEEP 6144:tidgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiS:tIqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 c65284f3d7cff1b6ae54d2d7e7bc3718d7624be31de07875702db2b44f6fc3ec
MD5 e0d2496c55f000347e7eda4a6106d503
SHA1 da1dbe6f73d8b323dd94a8e9178dbeb1c4ac34ba
SHA512 767231a6c1191d59934b74f9b521b57d01ccfa26adc162c81194a0841683301d82c693ea5baee5ac71bc8ee07f964efcce01e64d1ff7ac8f393859e8f09d50f3
SSDEEP 6144:t1dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:tXqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 db0efd82e5098a9b71621372410c12d01fb74b610df2f7ad781408fbb2145c50
MD5 64ec6ea5067d779960a0bf285fc1b232
SHA1 4445213ba3b2f1f743ebffef8e7862e6276e70d6
SHA512 03957c17fec31aaeefd48a9f19ce97c42d7f522f228499dedaca876636c3c6ac95c6e5f653e4890cfcd25310963e8470dd7c0e9a1266d974e134f8ebab744865
SSDEEP 6144:txdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhii:tDqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 ed31f8b0858b4c700e9389eb2b640a2373c0c8a544c3e379e52f9f61379cac77
MD5 753945f68292b7aeb7d8002f0116860e
SHA1 7fcf9bde08fab2af75edb09281972e50c0abacab
SHA512 8e11aeb2c2de1c39aa6ddb7c8e9c938ca5bdffd1d7f490791ee7c290e9025c85c56493c5d4fba0dbe2a7cd7cadc0a3991ee6cf1286109d97d7e8de164206af38
SSDEEP 6144:tSdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiK:t4qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 1ad776040114b3bc3186c662441ad65c3b0eb92fbe3df2d77552023a3bd39ae6
MD5 432acba707be588b03d74b6dc84099f5
SHA1 71427fd0c7fdbb21bf9441dcfa58a340b14b9abc
SHA512 cc71a6548433237b6787e800cb13d9bb19488b1d4fbe2478c263bbdd23b27edaac976eb092082b40733b1c8d038c2ab570d69dca75fda2ffd8072f37515f1305
SSDEEP 6144:tvdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:tVqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 d9e0e26a086644222b368da6bb50b45f73cac0b5128614f103598d4ddf1a81e5
MD5 883c88bb3481087e2afa74c69e7a035f
SHA1 e962888831a5e0a4166d0c3ae69155d650dea9ae
SHA512 8f78c0d5d195ae54fac3acf06d24f31be2a7d24e5c985bf92318c9ae2b50efd73b8fb914c3b10a3f416609e15904759380db40ea715f1f0f3f3f48141bccae84
SSDEEP 6144:tsdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi6:tmqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 3ab036489e18cc4de4d42b0aa74bd850e3b9d8c23066cae10852b318594c3c15
MD5 08ee52b632bbcf45978472ae989ad5c0
SHA1 f9460518c3cc6ac226b13b368e89a6cc60ba0f42
SHA512 7ea9cd769fe232ffed9a9bc2d8d27f3eea229f087c48c50dcc12bef166fab3dec5ec80e3eaa1e29019527780c54aaffc29ee7361acfb223b8d0a20ddd91e4868
SSDEEP 6144:tldgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:tHqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 fa89a2742fde272c1e58c3786a4bb649a2103947d0740823e9128fa2e9be2a10
MD5 5ad60c77f07c31045c9a27ba2c4a4406
SHA1 34590bcc8e75eb7d07030dbc802ba81f22988523
SHA512 75b6462696cd4364a08214102cd01a7eef0da16ae70223c11ed7a0960f5c47a3e81621491a33f39846944faabd2e377dc312046135e8f7681a57a5975d886a0c
SSDEEP 6144:thdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiq:tzqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 4c26a738c2cf9a6e713a8975c4699adb6e995a92d52b30754666114505f9bde2
MD5 405f55305d607b1a179b7b9b6bd8327a
SHA1 59a61bef70ad9a7c047d16fb05bddad237c7afc3
SHA512 63ac7ae82d195fbc8c558b96d9260263b1ff5d67259bddb6aacc38d500612a5b879d57410e5b6484194c1b8438d3143debf3667a1a8d87fa6c057156901ccca6
SSDEEP 6144:tAdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:taqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 536B
SHA256 e5d5005f7c9fdada426273f14e2ebe328b84f9161e80acc1396dadbe9897e98f
MD5 b4118bddcc9fe0ae73396b2b1b58c970
SHA1 23afa06fa78bbcc9c11e8549681fd4956f9d6c45
SHA512 fdc29fb8fafb990e52487b9ec22140dcbc8c684efa53da41e348584c623fff1a7ce1a9b3deaccdb25867479b393d52d199c8f09cb365e6c84e5980f6d4285b67
MD5 SHA1 SHA512

Submit Download

win.ini

Path C:\Windows\win.ini
Size 509B
SHA256 79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a
MD5 d2a2412bddba16d60ec63bd9550d933f
SHA1 deb3d3bdc9055f0b4909b31d3048446848fae0e1
SHA512 8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31
MD5 SHA1 SHA512

Submit Download

hab.exe

Path \Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 c9797e4ab85e0a7f794a57bf0b54e52b70e883a0e9f0fc4f303e55766c28724a
MD5 492be35fdc92d2bcab6a8bac3f74b266
SHA1 4ac680bb301e39e027d22e8da2b726dcfef2e430
SHA512 dcebf86bb616270521e96981d945413878b81acf0af0ad34e24418b862a96ae71881c48e3a2ab032d6219a88fffd40cd0c27cfb325acde25c5713a8df79fb9bf
SSDEEP 6144:tndgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiK:tdqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path \Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 c54f3127d1ac6feba299cfae65eaa979820002f5e0767d20ce28881dc130c448
MD5 9bdaa291ce8063cd77ef6959aa933bb3
SHA1 e4d10d7998847fe35ce24310f404b6fd5f966afc
SHA512 e5c389ef9140c0f47b24eef272e6d2818ef30d27aebbb69edfbe74977eb8ddcc262d34bc5a39690b6325d7107f283284af49c76efd47b690bd699324aa6e01dc
SSDEEP 6144:t6dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiS:tQqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path \Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 b9a29f1f360c2b4288cb68b368adeff7448d1e157f6cb21d8af4e477bcf2d05b
MD5 f13195aabb47fa5c1116d4d302a6c396
SHA1 85bc707c167ccc9c6f7dab481620cb481d1ffbe3
SHA512 9b4b24f45557e9dd08a5c84439a116b02b12fb6f604fdf1ef856dc817ebfd785d19c00b803241c18f8cc5c7f4e85e505ec1b29bb684961899b2ce8798ceee7ca
SSDEEP 6144:txdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:tDqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path \Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 48ffc421c2e79ecaff1a79570451e654fd59e6da65b785debccc6330aa58a240
MD5 95bab28cf22ad19359efec37b1176997
SHA1 cbbd71e8fb659ea242fa95b01e95e3a28d11ad76
SHA512 43945179483bcd9246acbeb5f85348ab288274726f94d6cd58f88747551b6de16ffbc1b153f85ebf90f768c612f721fad99980441a32bc674e0c963c02a3ab90
SSDEEP 6144:tAdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:taqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/572-2-0x00000000002A0000-0x00000000002A6000-memory.dmp

Download

memory/572-13-0x00000000777B0000-0x0000000077886000-memory.dmp

Download

memory/572-12-0x00000000002A0000-0x00000000002A6000-memory.dmp

Download

memory/572-5-0x00000000775C0000-0x0000000077769000-memory.dmp

Download

memory/572-4-0x00000000775C1000-0x00000000776C2000-memory.dmp

Download

memory/760-121-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/760-122-0x0000000000490000-0x0000000000496000-memory.dmp

Download

memory/760-128-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1020-332-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1020-340-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1020-334-0x0000000000390000-0x0000000000396000-memory.dmp

Download

memory/1048-77-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1048-79-0x00000000003E0000-0x00000000003E6000-memory.dmp

Download

memory/1048-85-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1288-163-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1288-165-0x00000000003A0000-0x00000000003A6000-memory.dmp

Download

memory/1288-171-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1652-199-0x00000000003F0000-0x00000000003F6000-memory.dmp

Download

memory/1652-198-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1652-205-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2088-313-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2088-306-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2148-15-0x00000000775C0000-0x0000000077769000-memory.dmp

Download

memory/2280-359-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2280-367-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2472-286-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2472-279-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2472-280-0x00000000002D0000-0x00000000002D6000-memory.dmp

Download

memory/2676-253-0x0000000002520000-0x0000000002526000-memory.dmp

Download

memory/2676-252-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2676-259-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2732-415-0x00000000005F0000-0x00000000005F6000-memory.dmp

Download

memory/2732-413-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2772-36-0x00000000002E0000-0x00000000002E6000-memory.dmp

Download

memory/2772-42-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2772-34-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2788-224-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2788-232-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2904-386-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2904-394-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2904-388-0x00000000002B0000-0x00000000002B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads