remcos | c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2025, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
Size 372KB
Sample250208-e1d4dawpdm
SHA256 c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41
MD5 c4195aa623f8eeddc85c52c6eed94237
SHA1 1caf5144268c47d69a44dc4dd0254a2fdd520a6c
SHA512 2110f3d31b8c1be9622a13451fea08713dace2467793267aa8341c49a1e1c2d15efed2a6478ce558abb6e2d9428a25e942538027e70b00437f8e8bd22580aafe
SSDEEP 6144:tedgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:t0qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos tino discovery persistence rat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

TINo

185.140.53.140:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
true
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-5S9O07
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Modifies WinLogon for persistence 2 TTPs 48 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	2636	Process not Found

Checks computer location settings 2 TTPs 64 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	hab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	remcos.exe

Executes dropped EXE 64 IoCs

pid	Process
3372	hab.exe
1572	hab.exe
1968	remcos.exe
4780	remcos.exe
3280	hab.exe
1480	hab.exe
1708	remcos.exe
3960	remcos.exe
1276	hab.exe
3564	hab.exe
2684	remcos.exe
1248	remcos.exe
1672	hab.exe
2508	hab.exe
4864	remcos.exe
3600	remcos.exe
4676	hab.exe
1348	hab.exe
872	remcos.exe
1632	remcos.exe
3956	hab.exe
1504	hab.exe
1916	remcos.exe
4780	remcos.exe
2060	hab.exe
4932	hab.exe
4480	remcos.exe
3496	remcos.exe
4716	hab.exe
3404	hab.exe
4628	remcos.exe
3928	remcos.exe
4200	hab.exe
4216	hab.exe
1988	remcos.exe
5044	remcos.exe
1312	hab.exe
4796	hab.exe
1632	remcos.exe
2800	remcos.exe
528	hab.exe
1504	hab.exe
2636	remcos.exe
1448	remcos.exe
444	hab.exe
1480	hab.exe
4260	remcos.exe
3616	remcos.exe
4112	hab.exe
4124	hab.exe
1292	remcos.exe
1780	remcos.exe
2780	hab.exe
3488	hab.exe
3828	remcos.exe
1128	remcos.exe
2732	hab.exe
1896	hab.exe
1212	remcos.exe
4412	remcos.exe
1892	hab.exe
2488	hab.exe
4532	remcos.exe
3080	remcos.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	hab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bru = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hab.vbs\""	hab.exe

Modifies WinLogon 2 TTPs 48 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	hab.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	hab.exe
File opened for modification	C:\Windows\win.ini	remcos.exe
File opened for modification	C:\Windows\win.ini	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3832	MicrosoftEdgeUpdate.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe
Key created	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000_Classes\Local Settings	hab.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4796	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
4796	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
884	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
884	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
3372	hab.exe
3372	hab.exe
1572	hab.exe
1572	hab.exe
1968	remcos.exe
1968	remcos.exe
4780	remcos.exe
4780	remcos.exe
3280	hab.exe
3280	hab.exe
1480	hab.exe
1480	hab.exe
1708	remcos.exe
1708	remcos.exe
3960	remcos.exe
3960	remcos.exe
1276	hab.exe
1276	hab.exe
3564	hab.exe
3564	hab.exe
2684	remcos.exe
2684	remcos.exe
1248	remcos.exe
1248	remcos.exe
1672	hab.exe
1672	hab.exe
2508	hab.exe
2508	hab.exe
4864	remcos.exe
4864	remcos.exe
3600	remcos.exe
3600	remcos.exe
4676	hab.exe
4676	hab.exe
1348	hab.exe
1348	hab.exe
872	remcos.exe
872	remcos.exe
1632	remcos.exe
1632	remcos.exe
3956	hab.exe
3956	hab.exe
1504	hab.exe
1504	hab.exe
1916	remcos.exe
1916	remcos.exe
4780	remcos.exe
4780	remcos.exe
2060	hab.exe
2060	hab.exe
4932	hab.exe
4932	hab.exe
4480	remcos.exe
4480	remcos.exe
3496	remcos.exe
3496	remcos.exe
4716	hab.exe
4716	hab.exe
3404	hab.exe
3404	hab.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4796	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
4796	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
884	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
884	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
3372	hab.exe
3372	hab.exe
1572	hab.exe
1572	hab.exe
1968	remcos.exe
1968	remcos.exe
4780	remcos.exe
4780	remcos.exe
3280	hab.exe
3280	hab.exe
1480	hab.exe
1480	hab.exe
1708	remcos.exe
1708	remcos.exe
3960	remcos.exe
3960	remcos.exe
1276	hab.exe
1276	hab.exe
3564	hab.exe
3564	hab.exe
2684	remcos.exe
2684	remcos.exe
1248	remcos.exe
1248	remcos.exe
1672	hab.exe
1672	hab.exe
2508	hab.exe
2508	hab.exe
4864	remcos.exe
4864	remcos.exe
3600	remcos.exe
3600	remcos.exe
4676	hab.exe
4676	hab.exe
1348	hab.exe
1348	hab.exe
872	remcos.exe
872	remcos.exe
1632	remcos.exe
1632	remcos.exe
3956	hab.exe
3956	hab.exe
1504	hab.exe
1504	hab.exe
1916	remcos.exe
1916	remcos.exe
4780	remcos.exe
4780	remcos.exe
2060	hab.exe
2060	hab.exe
4932	hab.exe
4932	hab.exe
4480	remcos.exe
4480	remcos.exe
3496	remcos.exe
3496	remcos.exe
4716	hab.exe
4716	hab.exe
3404	hab.exe
3404	hab.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4796	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
884	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
3372	hab.exe
1572	hab.exe
1968	remcos.exe
4780	remcos.exe
3280	hab.exe
1480	hab.exe
1708	remcos.exe
3960	remcos.exe
1276	hab.exe
3564	hab.exe
2684	remcos.exe
1248	remcos.exe
1672	hab.exe
2508	hab.exe
4864	remcos.exe
3600	remcos.exe
4676	hab.exe
1348	hab.exe
872	remcos.exe
1632	remcos.exe
3956	hab.exe
1504	hab.exe
1916	remcos.exe
4780	remcos.exe
2060	hab.exe
4932	hab.exe
4480	remcos.exe
3496	remcos.exe
4716	hab.exe
3404	hab.exe
4628	remcos.exe
3928	remcos.exe
4200	hab.exe
4216	hab.exe
1988	remcos.exe
5044	remcos.exe
1312	hab.exe
4796	hab.exe
1632	remcos.exe
2800	remcos.exe
528	hab.exe
1504	hab.exe
2636	remcos.exe
1448	remcos.exe
444	hab.exe
1480	hab.exe
4260	remcos.exe
3616	remcos.exe
4112	hab.exe
4124	hab.exe
1292	remcos.exe
1780	remcos.exe
2780	hab.exe
3488	hab.exe
3828	remcos.exe
1128	remcos.exe
2732	hab.exe
1896	hab.exe
1212	remcos.exe
4412	remcos.exe
1892	hab.exe
2488	hab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 884	4796	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	85
PID 4796 wrote to memory of 884	4796	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	85
PID 4796 wrote to memory of 884	4796	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	85
PID 884 wrote to memory of 3372	884	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	86
PID 884 wrote to memory of 3372	884	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	86
PID 884 wrote to memory of 3372	884	c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe	86
PID 3372 wrote to memory of 1572	3372	hab.exe	87
PID 3372 wrote to memory of 1572	3372	hab.exe	87
PID 3372 wrote to memory of 1572	3372	hab.exe	87
PID 1572 wrote to memory of 2228	1572	hab.exe	88
PID 1572 wrote to memory of 2228	1572	hab.exe	88
PID 1572 wrote to memory of 2228	1572	hab.exe	88
PID 2228 wrote to memory of 3576	2228	WScript.exe	89
PID 2228 wrote to memory of 3576	2228	WScript.exe	89
PID 2228 wrote to memory of 3576	2228	WScript.exe	89
PID 3576 wrote to memory of 1968	3576	cmd.exe	91
PID 3576 wrote to memory of 1968	3576	cmd.exe	91
PID 3576 wrote to memory of 1968	3576	cmd.exe	91
PID 1968 wrote to memory of 4780	1968	remcos.exe	92
PID 1968 wrote to memory of 4780	1968	remcos.exe	92
PID 1968 wrote to memory of 4780	1968	remcos.exe	92
PID 4780 wrote to memory of 3280	4780	remcos.exe	93
PID 4780 wrote to memory of 3280	4780	remcos.exe	93
PID 4780 wrote to memory of 3280	4780	remcos.exe	93
PID 3280 wrote to memory of 1480	3280	hab.exe	94
PID 3280 wrote to memory of 1480	3280	hab.exe	94
PID 3280 wrote to memory of 1480	3280	hab.exe	94
PID 1480 wrote to memory of 4820	1480	hab.exe	95
PID 1480 wrote to memory of 4820	1480	hab.exe	95
PID 1480 wrote to memory of 4820	1480	hab.exe	95
PID 4820 wrote to memory of 3448	4820	WScript.exe	96
PID 4820 wrote to memory of 3448	4820	WScript.exe	96
PID 4820 wrote to memory of 3448	4820	WScript.exe	96
PID 3448 wrote to memory of 1708	3448	cmd.exe	98
PID 3448 wrote to memory of 1708	3448	cmd.exe	98
PID 3448 wrote to memory of 1708	3448	cmd.exe	98
PID 1708 wrote to memory of 3960	1708	remcos.exe	99
PID 1708 wrote to memory of 3960	1708	remcos.exe	99
PID 1708 wrote to memory of 3960	1708	remcos.exe	99
PID 3960 wrote to memory of 1276	3960	remcos.exe	100
PID 3960 wrote to memory of 1276	3960	remcos.exe	100
PID 3960 wrote to memory of 1276	3960	remcos.exe	100
PID 1276 wrote to memory of 3564	1276	hab.exe	101
PID 1276 wrote to memory of 3564	1276	hab.exe	101
PID 1276 wrote to memory of 3564	1276	hab.exe	101
PID 3564 wrote to memory of 1768	3564	hab.exe	102
PID 3564 wrote to memory of 1768	3564	hab.exe	102
PID 3564 wrote to memory of 1768	3564	hab.exe	102
PID 1768 wrote to memory of 4628	1768	WScript.exe	103
PID 1768 wrote to memory of 4628	1768	WScript.exe	103
PID 1768 wrote to memory of 4628	1768	WScript.exe	103
PID 4628 wrote to memory of 2684	4628	cmd.exe	105
PID 4628 wrote to memory of 2684	4628	cmd.exe	105
PID 4628 wrote to memory of 2684	4628	cmd.exe	105
PID 2684 wrote to memory of 1248	2684	remcos.exe	106
PID 2684 wrote to memory of 1248	2684	remcos.exe	106
PID 2684 wrote to memory of 1248	2684	remcos.exe	106
PID 1248 wrote to memory of 1672	1248	remcos.exe	107
PID 1248 wrote to memory of 1672	1248	remcos.exe	107
PID 1248 wrote to memory of 1672	1248	remcos.exe	107
PID 1672 wrote to memory of 2508	1672	hab.exe	108
PID 1672 wrote to memory of 2508	1672	hab.exe	108
PID 1672 wrote to memory of 2508	1672	hab.exe	108
PID 2508 wrote to memory of 3048	2508	hab.exe	109

C:\Users\Admin\AppData\Local\Temp\c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
"C:\Users\Admin\AppData\Local\Temp\c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe
  "C:\Users\Admin\AppData\Local\Temp\c6c45efa1a66300fbb2d041ed423015f92ce8fc22b226421e0cfbe0cc98bce41.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Users\Admin\AppData\Local\Temp\hab.exe
    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\hab.exe
      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Modifies WinLogon
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1572
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2228
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        10⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        11⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        13⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        14⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        16⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        17⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        18⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        19⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        22⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        23⤵
        Checks computer location settings
        
        PID:3048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        24⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4864
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        26⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        28⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1348
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        29⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        30⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        31⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:872
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        34⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1504
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        35⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:3912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        36⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        37⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        40⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4932
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        41⤵
        
        PID:392
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        42⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        43⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4480
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        44⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        45⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        46⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        47⤵
        Checks computer location settings
        
        PID:1768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        48⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4628
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        50⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        51⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        52⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4216
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        53⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        54⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        55⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        56⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        57⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        58⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4796
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        59⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        60⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        61⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1632
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        62⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        63⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        64⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1504
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        65⤵
        Checks computer location settings
        
        PID:2544
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        66⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        67⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        68⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        69⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        70⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Modifies WinLogon
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        71⤵
        Checks computer location settings
        
        PID:3820
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        72⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        73⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4260
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        74⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        75⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        76⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Modifies WinLogon
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        78⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        79⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        80⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        81⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        82⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        83⤵
        Checks computer location settings
        
        PID:4064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        84⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        85⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3828
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        86⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        87⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        88⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Modifies WinLogon
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1896
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        89⤵
        Checks computer location settings
        
        PID:3880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        91⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1212
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        92⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        93⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        94⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:2488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        96⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        97⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        98⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        99⤵
        Adds Run key to start application
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        100⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        101⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:3292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        102⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        103⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        104⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        105⤵
        Drops file in Windows directory
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        106⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        107⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        108⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        109⤵
        Drops file in Windows directory
        
        PID:1372
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        110⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        112⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:3396
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        113⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        114⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        115⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        116⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        117⤵
        Adds Run key to start application
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        118⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        119⤵
        Checks computer location settings
        
        PID:1212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        120⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        121⤵
        Drops file in Windows directory
        
        PID:4696
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        122⤵
        Checks computer location settings
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        123⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        124⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:3168
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        125⤵
        
        PID:460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        127⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:612
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        128⤵
        Checks computer location settings
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        129⤵
        Adds Run key to start application
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        130⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        131⤵
        Checks computer location settings
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        132⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        133⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        134⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        135⤵
        Adds Run key to start application
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        136⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        138⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        139⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        140⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        141⤵
        Adds Run key to start application
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        142⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        145⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        146⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        147⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        148⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Modifies WinLogon
        Modifies registry class
        
        PID:3056
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        150⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        151⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        152⤵
        Checks computer location settings
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        153⤵
        Adds Run key to start application
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        154⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Modifies WinLogon
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        155⤵
        Checks computer location settings
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        156⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        157⤵
        Drops file in Windows directory
        
        PID:3760
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        158⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        159⤵
        Drops file in Windows directory
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        160⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        Modifies registry class
        
        PID:2912
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        161⤵
        Checks computer location settings
        
        PID:1680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        163⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        165⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        166⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        167⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        169⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        170⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        171⤵
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        172⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        
        PID:3172
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        173⤵
        Checks computer location settings
        
        PID:4040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        174⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        175⤵
        Drops file in Windows directory
        
        PID:3440
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        176⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        177⤵
        Drops file in Windows directory
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        178⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1120
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        179⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        180⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        181⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        182⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        183⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        184⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        185⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        186⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        187⤵
        Drops file in Windows directory
        
        PID:3404
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        188⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        190⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        191⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        193⤵
        Drops file in Windows directory
        
        PID:1048
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        195⤵
        Adds Run key to start application
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        196⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        198⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        199⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        201⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        202⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3044
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        203⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        204⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        205⤵
        Drops file in Windows directory
        
        PID:2488
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        206⤵
        Checks computer location settings
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        207⤵
        Adds Run key to start application
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        208⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        209⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        210⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        211⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        212⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        213⤵
        Adds Run key to start application
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        214⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        215⤵
        Checks computer location settings
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        217⤵
        Drops file in Windows directory
        
        PID:3340
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        218⤵
        Drops file in Windows directory
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        219⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        220⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        222⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        223⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        224⤵
        Drops file in Windows directory
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        225⤵
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        226⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Modifies WinLogon
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        228⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        229⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        230⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        231⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        232⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Modifies WinLogon
        Modifies registry class
        
        PID:2428
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        233⤵
        Checks computer location settings
        
        PID:2840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        234⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        235⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        236⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        237⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        238⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        239⤵
        Checks computer location settings
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        240⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        241⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        242⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        243⤵
        Adds Run key to start application
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        244⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        245⤵
        Checks computer location settings
        
        PID:1596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        246⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        247⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        248⤵
        Drops file in Windows directory
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        249⤵
        Adds Run key to start application
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        250⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        251⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        252⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        253⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        254⤵
        Checks computer location settings
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        255⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        256⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        257⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        258⤵
        System Location Discovery: System Language Discovery
        
        PID:640
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        259⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        260⤵
        Checks computer location settings
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        261⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        262⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        
        PID:2764
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        263⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        264⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        265⤵
        Drops file in Windows directory
        
        PID:4152
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        266⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        267⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        268⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        
        PID:3592
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        269⤵
        Checks computer location settings
        
        PID:4336
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        270⤵
        
        PID:312
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        271⤵
        System Location Discovery: System Language Discovery
        
        PID:3932
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        272⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        273⤵
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        274⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Adds Run key to start application
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        275⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        276⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        277⤵
        Drops file in Windows directory
        
        PID:372
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        278⤵
        Checks computer location settings
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        279⤵
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        280⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Modifies WinLogon
        Modifies registry class
        
        PID:2916
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        281⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
        282⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        283⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        284⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        285⤵
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\hab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        286⤵
        Modifies WinLogon for persistence
        Modifies WinLogon
        Drops file in Windows directory
        Modifies registry class
        
        PID:3440
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:2088

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTBFMEY4OUQtRkNBNS00RTMwLUExMjctODU3N0I0QjE3OTM4fSIgdXNlcmlkPSJ7OTU3RjA1QjgtNkY3My00MkNCLUJFNDktQ0NFODAwQkQ1QTRBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RkFBRDlDNkEtOUIyQi00NDkxLUEzQ0EtRjA0MzNGOTRGQ0Q0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU1NzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODAxNjUyMzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDIwMTIxNDUwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 6693b2a79542ce7d62fcc7040d5e8415a46334b8ac19ab889fa2398a7f847ed5
MD5 3fa9a4f8dc35ac67f01fe5499fdc8e89
SHA1 570fa552748cc9d84484809b5f906f5038c308fd
SHA512 4c3503c9e76548ab13dfbf523d5468305488bd5942cbd889b88aa23cc4631a6fab8d2b2382f47db18bc41471a9887ce131b4d1254dce52133fb58fe226f3fb88
SSDEEP 6144:tndgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:tdqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 5af09381e4d8c4c6348f7b08dc8cb2fd07fcb67e8bd4a65791c8da7d2730c2bb
MD5 69ba486646238e709a20620c78b9ab2a
SHA1 a4b4b46924f915ab6eb4b05fa5e8d3b1f248855f
SHA512 a3d1876e9c45a67ede69eff54db580fe526e14156396c2bab0b2e0d87686ffbb78289351f8e5ad57b2ddf9e70812ab6770ad02b57ef4292b6e3451b3889a0539
SSDEEP 6144:tgdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiK:t6qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 0cf0a7636311ccfa1365a60c19f437228e6d2c225724e168fc4038dee34c60ac
MD5 3b66a82f63ed0f8934eeed4082d96e79
SHA1 e95f6beccbbd34f29a1a28fdcfad43e5752d2473
SHA512 ed0e9f7423d453d2481764cffc131ddecc6308025b0994733e28be449ed9b937095232222e7ab5ae579d4df64797ed3dd3a81f66bfedc8aa84011e042c6ce195
SSDEEP 6144:t5dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:tbqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 491b1db716de2ee012bc62f22cdf2dc67c7fef15334a980e51755769c4cc89e8
MD5 83c1b4d9c302053bc8cc143c8200e18d
SHA1 3db83e534b50ef299f459def04c135fb88c064e8
SHA512 af0eff0e485a621e762dfc6186ac1d4f8463a58ffac92e1ea718d6f55a132888c7e9b41d6543e4c9e6fd389b96de2d4fb5b13641c5d57b3f2d5fbda3ff567f65
SSDEEP 6144:tRdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi6:tjqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 2bf39787930b881e72b52738ae2714046f73ab837da0c963809c98ac2eacb143
MD5 c2e5c91e7af4661fd0df60f5b831928a
SHA1 f130a041b5913985bd02ee3dd0c7ed86bb0604d8
SHA512 2d3bc81d20bdd47e736eb5a821db2638ac6cca2dfcf60ce81d2d8f301d8bb2b7e024b5d90d601ff07b3d0ffeeb6f599b4d566e946b6e6a44bfd7a4f908a822b2
SSDEEP 6144:tYdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:tiqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 11a7138f31a6115f20fe06a7892a9e8bc4a2fb90b8e69da507cd96158badbc85
MD5 ad05b4dde6ef1929ef3bf6ac61a06a79
SHA1 a3b6e3fef9ccdec3bfe46e8bd1ed8c73a63bc8f7
SHA512 fef1c848e69073a6a1552b30313b6c0f43e8d44ec43de30e2e5225beb903305848eafc73b99b2d641a916437bc8480f8e50e19108b81b4c7c1cc1c5dd9f4defc
SSDEEP 6144:tndgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiq:tdqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 9eac5164744494fad37d728da22c447a58ff0864d29050a6271d1acfff0c7452
MD5 d5ff66c4edd0154dbe219bf81fdbfe2c
SHA1 8f15269dd78a65413f579fe032289ffc80416658
SHA512 e7a26f7a6ffd00cc2bba77e6f9e4773822e23756b698db59e3e9c570d3bb088bf02a902f3c165ac27eefc633898a93c33568a9c9eefc10a614e3fa3d1fbc9766
SSDEEP 6144:tidgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiS:tIqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 c65284f3d7cff1b6ae54d2d7e7bc3718d7624be31de07875702db2b44f6fc3ec
MD5 e0d2496c55f000347e7eda4a6106d503
SHA1 da1dbe6f73d8b323dd94a8e9178dbeb1c4ac34ba
SHA512 767231a6c1191d59934b74f9b521b57d01ccfa26adc162c81194a0841683301d82c693ea5baee5ac71bc8ee07f964efcce01e64d1ff7ac8f393859e8f09d50f3
SSDEEP 6144:t1dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:tXqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 db0efd82e5098a9b71621372410c12d01fb74b610df2f7ad781408fbb2145c50
MD5 64ec6ea5067d779960a0bf285fc1b232
SHA1 4445213ba3b2f1f743ebffef8e7862e6276e70d6
SHA512 03957c17fec31aaeefd48a9f19ce97c42d7f522f228499dedaca876636c3c6ac95c6e5f653e4890cfcd25310963e8470dd7c0e9a1266d974e134f8ebab744865
SSDEEP 6144:txdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhii:tDqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 ed31f8b0858b4c700e9389eb2b640a2373c0c8a544c3e379e52f9f61379cac77
MD5 753945f68292b7aeb7d8002f0116860e
SHA1 7fcf9bde08fab2af75edb09281972e50c0abacab
SHA512 8e11aeb2c2de1c39aa6ddb7c8e9c938ca5bdffd1d7f490791ee7c290e9025c85c56493c5d4fba0dbe2a7cd7cadc0a3991ee6cf1286109d97d7e8de164206af38
SSDEEP 6144:tSdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiK:t4qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 1ad776040114b3bc3186c662441ad65c3b0eb92fbe3df2d77552023a3bd39ae6
MD5 432acba707be588b03d74b6dc84099f5
SHA1 71427fd0c7fdbb21bf9441dcfa58a340b14b9abc
SHA512 cc71a6548433237b6787e800cb13d9bb19488b1d4fbe2478c263bbdd23b27edaac976eb092082b40733b1c8d038c2ab570d69dca75fda2ffd8072f37515f1305
SSDEEP 6144:tvdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:tVqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 d9e0e26a086644222b368da6bb50b45f73cac0b5128614f103598d4ddf1a81e5
MD5 883c88bb3481087e2afa74c69e7a035f
SHA1 e962888831a5e0a4166d0c3ae69155d650dea9ae
SHA512 8f78c0d5d195ae54fac3acf06d24f31be2a7d24e5c985bf92318c9ae2b50efd73b8fb914c3b10a3f416609e15904759380db40ea715f1f0f3f3f48141bccae84
SSDEEP 6144:tsdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi6:tmqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 3ab036489e18cc4de4d42b0aa74bd850e3b9d8c23066cae10852b318594c3c15
MD5 08ee52b632bbcf45978472ae989ad5c0
SHA1 f9460518c3cc6ac226b13b368e89a6cc60ba0f42
SHA512 7ea9cd769fe232ffed9a9bc2d8d27f3eea229f087c48c50dcc12bef166fab3dec5ec80e3eaa1e29019527780c54aaffc29ee7361acfb223b8d0a20ddd91e4868
SSDEEP 6144:tldgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:tHqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 fa89a2742fde272c1e58c3786a4bb649a2103947d0740823e9128fa2e9be2a10
MD5 5ad60c77f07c31045c9a27ba2c4a4406
SHA1 34590bcc8e75eb7d07030dbc802ba81f22988523
SHA512 75b6462696cd4364a08214102cd01a7eef0da16ae70223c11ed7a0960f5c47a3e81621491a33f39846944faabd2e377dc312046135e8f7681a57a5975d886a0c
SSDEEP 6144:thdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiq:tzqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 4c26a738c2cf9a6e713a8975c4699adb6e995a92d52b30754666114505f9bde2
MD5 405f55305d607b1a179b7b9b6bd8327a
SHA1 59a61bef70ad9a7c047d16fb05bddad237c7afc3
SHA512 63ac7ae82d195fbc8c558b96d9260263b1ff5d67259bddb6aacc38d500612a5b879d57410e5b6484194c1b8438d3143debf3667a1a8d87fa6c057156901ccca6
SSDEEP 6144:tAdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:taqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 3689012eb16256ea1d2d8f6e6b735af74b67749556b5e893dcd477f2f5505e84
MD5 1d6ff9cc545b963a8aaaff5251df446e
SHA1 85428b43e390152524c678492501b8f8c124cb95
SHA512 5a8e0b00f613a36f4634e1d45d81ba3325627a51c34e89447d86c3c998d0078282f1bd1dc83579372e1ee1879005d7769d07e056723e2b2809dce3d7b5937ce1
SSDEEP 6144:tDdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:tpqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 deba3e4529398240107087fcd885394b66a9fd6f046c6fd0287920345eb75766
MD5 ffae18e526a0e593bd492ea864e54139
SHA1 bd05a01a62e3923fbb7c3a6dbec5ffc6f8ba382a
SHA512 9ce725aa77d445ea8b1b7a441ff7f7c500bf1b9435a78e0d16531b5bdd0032eddae6119ca7ca9bc33f66095e4afaef4acd692547a499f9a1a1b5c82c00cd6b0c
SSDEEP 6144:t/dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiW:tlqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 dae2e59d29e61282037ca2714ebc11742fc60507fe464092b1bb06eb75f5f5ef
MD5 5b90980303548c52dedcafa249f16ad8
SHA1 6b2c725ed4b0bacad02f52cc160450a1d02d7ec4
SHA512 88da42df063f938f06c43b8ff2f2798395af41103d9b363eb47cb73cce57d6b6beb09d417eeeb5922954768767b9272cc5607d0cef612dbc147f3db8bf44e937
SSDEEP 6144:t8dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhim:t2qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 bf06d23d2d5f2ed6d52d0a3b9e0799af2768dcffbfd17043966e4ac56219eb78
MD5 fced5e80ca7da337473a53f9b75a885b
SHA1 2c1cbf5150b44e65ecf1e7fa3de4e5cdd1928c48
SHA512 b3828b3aec6cf6a8299888d629fb0954c9d5be8519781f5efe7a31a0ed48743cfbc81e6432463c8194049629eba205c6712048a8e291bd71340f49a78adc5adb
SSDEEP 6144:tIdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi2:tSqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 6d1d1f7a86583a7bb0238aacb71fe7e534e6b7d50c2e2b50de65a6ceaa8073db
MD5 ffc2c6cdc86fb97436d4e81bb512ab32
SHA1 aecbe631a14849730e2a429e9076d7846bec3724
SHA512 1265fd5b0abffddaad0f8fcb15371c4a783ed112486f0aa1f0f02a86aab08569b4fe08682f81cc3f6c7fab5a739ceb13d28672453b91ed26075ac4be6704553e
SSDEEP 6144:tndgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhim:tdqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 dfa335fe51b0720f753476139567b1c989b9b50247e762c4cc704bdc2167db78
MD5 a0b0b3f447e10d9216505b0539ca1ee6
SHA1 1bac2cf1e487f2f9fc4fbd421b76d199475730d1
SHA512 117f6eb8665ecd76c800ab3c2110251efb1a284fedeab995175acfd46e1f5855122219a918384f89892465f382d298f894fa6160d34bd0ac85e74015b5cab4a4
SSDEEP 6144:tZdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi+:t7qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 1d2cfdf1260fd3734f0e2e2e7b48308e2d88a64a41be7c7e4ccd7639239ff227
MD5 f11997be38b0d0518fa2116532ce8541
SHA1 0c067991378cf96d21edb6e5cc1390c1a5fe99de
SHA512 9cc4febb46929ee496159e8fd3887d903d341f88cf7b5130af75f6b9de681c7133ed8fdbe70c91cfaf490ef7e009a451df840828fe0a7fed2a28edb9a8bb557a
SSDEEP 6144:t8dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi+:t2qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 34d185d2420994d47b0cdb8f673aba5974a81aaa7c0202b75b7fe49fe4a9212f
MD5 d1287ddb696e285e536f304b8d3f3609
SHA1 45f4412e1378c64cc1497a6827b898145a12935b
SHA512 264ccf2947f3f7be9591722149eb4b15944f8befa285406e1229ec9ebede23f8b40d88dd7ad40f49697d76369705a7db5cb54996764d05d75a241bbdde161df5
SSDEEP 6144:tgdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi+:t6qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 ee61140d969ca10e13f4c3ffb5057c010537e9bc5a1158464880c7c6ac86d307
MD5 923de2d5536eb6ad365fffd9ba4298cc
SHA1 33bb9f9f54fd97ce1998fe91c19af26db68af985
SHA512 a43a162b8d3b0a862b3c83ada99aae596225042837a93282668b44a54559a5e8b6eae4c2ad205d6c9e2ea778daea82c0ccd925571a0eee2dce53af837a1d7b79
SSDEEP 6144:tNdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhim:tfqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 782d5a113f60db54637aac2aaaca9aa4e0a60a3780ce8e5a2bc69bc5317c2447
MD5 c1e7cc26a8f8a8d09f098a7c70d34835
SHA1 327f4ba03db092bf561c1eac601c91d00fa32d5d
SHA512 3083733172b36cedc15d6a8cc801d0165ed3871fc0cd59bee9875a96f047a743b1251d8c90fc38f52079947478b75de49df2f1fb6a49b1f6d34cb1d51b7a31d0
SSDEEP 6144:tadgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi2:twqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 dfe45c98b5ed2759dea3af5d7f4e6639bc342028f5cfa9ac3dd325343ac09fc1
MD5 81131709f86e556dfea1505467270ab2
SHA1 14703d015d376d42d20bffa0156a170ad5e40a6c
SHA512 9b91470f4fc793951fec1421ebf4e3bf324ca08ed4e4ef277de78cec2d2f674242a38508e1c696c641245f8664cc18fa57dd5c15db557608c447cc761ada5152
SSDEEP 6144:tLdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhim:tBqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 d70491c4b550f40cdba733022031661ba0484d57653c9456ec0d57d3a3d1000c
MD5 899f9c97f306bcfc23eee0050ad4bd96
SHA1 710f3805a77f0f94b3c32025867d0547c267194d
SHA512 66723bb4b1b2e9f4667e9197e9b52d2e8be1de2cb86019ebb082509570db1b2e49b5c30524d9fa3295f3b48ce4c89551bffd05e2699f4f58065be7bdf403925b
SSDEEP 6144:tUdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiW:teqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 fbdde135e9421be32f9db4ccf63d609faeb2f0ed271c5f9722394ae091ff58a2
MD5 e10e9434a754f3781071e1887e528e87
SHA1 89c908ca9be1b4b121b1a8210ffee47f9be920f0
SHA512 5046d03b9383cf1b0d24b78be6c90337f25f9bbef9050730dabc1d0e7e7d559a952cb341e1f5bf853bef9c14700fa90eaf047f38715a8d6603c80444d8b7783f
SSDEEP 6144:tpdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhie:tLqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 9f2c94bb8a741652ed26aca8dd4d9ebdd169d1019ff387220a077a868341985e
MD5 43f1d2902b43461474ba089b24c81dfe
SHA1 866c6b195f70e3a0cf38d4af739f5c7c87162323
SHA512 ba8da7706dc72d30839bb194311b8b75662afa3cd15d20389ed4456c290d2519796c76621f72ef33eb525ea5180f833801037c27e0d235764c96d14714cc01d8
SSDEEP 6144:tndgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhie:tdqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 e97d553373a3f4840480b2f183f677350739f33126956a3707d5ea4bff205854
MD5 e58f1949152c966657777ec444e9be1a
SHA1 b32cb58830303d7cb2f129f25bd294e05bf98054
SHA512 a3220181473bd79e34447202b119836d31ef5f79994e38da415bae243fdb81c66781f2a50582a5b0d702f1649c48f86bebf9d7a583fe55a76c0bc5c41e8043d0
SSDEEP 6144:tedgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi+:t0qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 79fee51e24bb327209ad796e4fc67dfd609918aff89de677e0d737bdd4ab124b
MD5 276c2d1ccd94326cfd8247e26e1afd75
SHA1 44cc0d62310ea954dd293bea159358881c4cac2e
SHA512 e7fde9a88570c4fb8f80306a960d95239c8b53ef8a2f98f856272689c494af74946099d29ae906dc87a13a8926c1c4c5cef83fd1d7bad130523858de9d847951
SSDEEP 6144:tVdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:t3qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 dec08d25c0459aadd23f54358482a45acd78dd259f6fd6a6dbfaedcf1c8c3ee2
MD5 642325ea5ed592c77c897515cf32860a
SHA1 6af144076a845c0ad11b91f4aa9d4de98c2ed530
SHA512 5d9e8d7a01dfdac388009afe002cd8350c44d4765bc59ca35ae9c28645cb6467835ba7d5421f0a9c74d5881a281a3146ce84abc6a87d5e578d2c3a54f624aa02
SSDEEP 6144:tZdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiK:t7qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 f174ad8e1e90a147c492b0a4b031d57ec48f627f1775fa227e38ab4941d371da
MD5 a7f5da2805317129f63f5d1861fe83c5
SHA1 5cdb76040424d7f62e5ce4e688dad3dea5ba4b31
SHA512 39917f8acd9dc61562c4cf33d404f4ead86b03987791e58b2ad3e574e54175d7e1b8765146364b9fd1e6246f6e57ce5c1febe2f717d7804aae09deb771790c7d
SSDEEP 6144:tAdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:taqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 d4539a499a94c789549e0ad8b2f74a6b3933d6f79b3e48632ad3e82d1c723de9
MD5 7683402917d0898a0575c94484cc98fe
SHA1 8aa13607ed980a38818ddc6bc16637dc404968fb
SHA512 184b0a4b3a68d443e3114e0772ae5231d4566181c1a32159d021238708f1b763f81d527707e9da8b94ab91117217240f56e5b6a9d78a454f141dc3c27a882255
SSDEEP 6144:tTdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi6:t5qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 21d11c27ac25af83d66729281e72a507e50c3291618f38a584108221251f128d
MD5 1a6b81a82298e96dd1449f7327c9c0b3
SHA1 4b77fa2cf4e0159b2c4cfc0b4dd3fcdd873127f2
SHA512 cb0f6686c54b0298c5f50dceb857a09119e4cd5e1da5d239897e72a99f7658d8c67b604389ebb00d72c283a3b0b28ca3e3a8c230809691ff301d4db059df6ea8
SSDEEP 6144:tmdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhii:tsqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 4a06ef22f822841455f986f3e488b2cea46f1a39a11a6311ff1bc92fa945b366
MD5 4c254edc33d469ca76f044824bd20227
SHA1 ad8e2e1251af9b8ef58993cc0150dfade1087d2b
SHA512 12aae2dce33d8ef0808d716b005a899d84dc149977fca643f4c4653f96ff3021271ca6e62723be7c4d57a9079c7db6cea1780e73830ba6cc203e3d224e5f510b
SSDEEP 6144:tldgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiq:tHqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 0aa1cd2f992698b327914a7bec23effe010277e40455e3c614f7f70656b97f0a
MD5 383e0aa92adfe983a14c0909962bf626
SHA1 2bdc4a763023e03f7a972e0e4f286ddc94b5234c
SHA512 61d6a4a7b626f99133687e8094274b612f79b7d70a5fa7ef201617cda5268081646d0e1012eb8dad7c7fb00bfd09d22e9c2619d2b0b6c9fdee673aeb26dd93cc
SSDEEP 6144:tldgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC:tHqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 de3df1b823636e29d882dc73b743a657646eaa3a1e19c7aa6a92aa31fce1359b
MD5 eeaf00f004e6f115dc12912d59b4349b
SHA1 b66cf603ed18e53ee4684a549f8558c1c6c5db2d
SHA512 42107a2890fb112f4f2aadf1ecbe4b047735ef0e6de8ab9a671627bc6da7874454a2bb49ccf9e4a5fbed50a745b1c023d2a90af81d1d9c35de61c04b647b61c1
SSDEEP 6144:tGdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhie:tMqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 d6649b26ab45e7960a671e56820b7f397bc31f7bf5d0b12eca9805dd356fea83
MD5 33c40767f4ac20d8944d27b0bb48e82e
SHA1 7955c0f908d464e420b8108cc40344a6946a6140
SHA512 ca304e6056713bbc2b83ec6f457d6955bc8518ed5226c7238d57002e38d2ec15216953fa96a389e29135528c4ccc6749dbbe6815d9755d88c69d886946490741
SSDEEP 6144:t0dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:t+qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 0142efde1a5ebaac18ea16d97b409a4b96fd3bdacce9d7064ae12707503e98c5
MD5 c7affc0012ef03e91d936eb013116566
SHA1 2fb100c307382a441dcd18ccdbe78a9bc6897603
SHA512 dc2eb7fae3195f74f7569220769096a91128fbe6fffbd4b20720dd79b3f74777802ae98bbe435e934e93e269d91e15d5e49f8abd28398e23768e0e9ed312456b
SSDEEP 6144:tidgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:tIqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 b9a29f1f360c2b4288cb68b368adeff7448d1e157f6cb21d8af4e477bcf2d05b
MD5 f13195aabb47fa5c1116d4d302a6c396
SHA1 85bc707c167ccc9c6f7dab481620cb481d1ffbe3
SHA512 9b4b24f45557e9dd08a5c84439a116b02b12fb6f604fdf1ef856dc817ebfd785d19c00b803241c18f8cc5c7f4e85e505ec1b29bb684961899b2ce8798ceee7ca
SSDEEP 6144:txdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhia:tDqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 48ffc421c2e79ecaff1a79570451e654fd59e6da65b785debccc6330aa58a240
MD5 95bab28cf22ad19359efec37b1176997
SHA1 cbbd71e8fb659ea242fa95b01e95e3a28d11ad76
SHA512 43945179483bcd9246acbeb5f85348ab288274726f94d6cd58f88747551b6de16ffbc1b153f85ebf90f768c612f721fad99980441a32bc674e0c963c02a3ab90
SSDEEP 6144:tAdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:taqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 c9797e4ab85e0a7f794a57bf0b54e52b70e883a0e9f0fc4f303e55766c28724a
MD5 492be35fdc92d2bcab6a8bac3f74b266
SHA1 4ac680bb301e39e027d22e8da2b726dcfef2e430
SHA512 dcebf86bb616270521e96981d945413878b81acf0af0ad34e24418b862a96ae71881c48e3a2ab032d6219a88fffd40cd0c27cfb325acde25c5713a8df79fb9bf
SSDEEP 6144:tndgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiK:tdqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 c54f3127d1ac6feba299cfae65eaa979820002f5e0767d20ce28881dc130c448
MD5 9bdaa291ce8063cd77ef6959aa933bb3
SHA1 e4d10d7998847fe35ce24310f404b6fd5f966afc
SHA512 e5c389ef9140c0f47b24eef272e6d2818ef30d27aebbb69edfbe74977eb8ddcc262d34bc5a39690b6325d7107f283284af49c76efd47b690bd699324aa6e01dc
SSDEEP 6144:t6dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiS:tQqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 2b3b73ddfbca87cea8071d406a2e7209f929bc0a957a417dbf7dfc13f48238c6
MD5 9a2db9a5cbbac3a2120657a73f8626b9
SHA1 b0f3d67893b65b2ea7c63dfb04b806188b1a8d50
SHA512 de23363956f47e5b6365a2396a1046e667b9ee90e6ec6641d90cdb5b1a9bfc4b4ae4342f82c8ba713932c3f9f461f826b27bbacd8d5c7c8b9165fd4c4331514a
SSDEEP 6144:tNdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhi6:tfqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 06641f86245cc0d502d640b62a1c80a96d41d1d4a1105633eaa6b1ad77c4d37b
MD5 b7d085b11683b05ba12e7d894c6d039e
SHA1 f4d8916121fd0e4a131f73f004c1b0b7eeabb589
SHA512 34a8ac2cef5d4c52d2cdc71f0c72ab434473769d1151981445c8424a750f4b34db9259b828633259d755ca42b96886ff36a61c7e6bed8ef9026364d9ca8490f4
SSDEEP 6144:tJdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:trqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 04c0cf6cd4ffd82def776a84e470823863a7380aa2b36ecb159620524ddc9f2e
MD5 c11f01ee53aadf5d4b31ba29a621004c
SHA1 ca1d866a7e6b2d454f67c83629abe19edc835ce1
SHA512 eae55da15245e3f0f678fdab0c56a474de9c9ebbc91dc111c61632a60cd7560fc50d60d7d3d0574c7b7d1c4292cc6d866a2a06eb40c0140b5286a39b4a000c92
SSDEEP 6144:tidgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiq:tIqQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hab.exe

Path C:\Users\Admin\AppData\Local\Temp\hab.exe
Size 372KB
SHA256 53b33d2e7f6226bb41d0ae988f82b5d72b8e4d3a61ac6305683cd67fb7378625
MD5 968c4bdff6476bdd4a4b47a4c96aae5f
SHA1 abe4ad20cd006afc9ed74b0b92a6c4d7a2281ebb
SHA512 3aade9ee571c44f399971d52272aa1a1e9d2f40a1c523b451b9eef0a3561e626cefe87365efe6e834ea7a04fa40a85ab3956c77a481fe45efbf47be56b677587
SSDEEP 6144:tHdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiy:t9qQx+H2i+8LBNbdypazCXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 536B
SHA256 e5d5005f7c9fdada426273f14e2ebe328b84f9161e80acc1396dadbe9897e98f
MD5 b4118bddcc9fe0ae73396b2b1b58c970
SHA1 23afa06fa78bbcc9c11e8549681fd4956f9d6c45
SHA512 fdc29fb8fafb990e52487b9ec22140dcbc8c684efa53da41e348584c623fff1a7ce1a9b3deaccdb25867479b393d52d199c8f09cb365e6c84e5980f6d4285b67
MD5 SHA1 SHA512

Submit Download

win.ini

Path C:\Windows\win.ini
Size 123B
SHA256 6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
MD5 6bf517432f65eb7f0d18d574bf14124c
SHA1 5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727
SHA512 7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06
MD5 SHA1 SHA512

Submit Download

memory/884-11-0x00007FFE2F2D0000-0x00007FFE2F4C5000-memory.dmp

Download

memory/1348-205-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1348-207-0x00000000021C0000-0x00000000021C6000-memory.dmp

Download

memory/1348-214-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1480-459-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1480-452-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1480-82-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1480-75-0x00000000020C0000-0x00000000020C6000-memory.dmp

Download

memory/1480-73-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1504-426-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1504-420-0x0000000000540000-0x0000000000546000-memory.dmp

Download

memory/1504-418-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1504-251-0x0000000000640000-0x0000000000646000-memory.dmp

Download

memory/1504-249-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1504-258-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1572-31-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1572-39-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1572-33-0x00000000028A0000-0x00000000028A6000-memory.dmp

Download

memory/2508-161-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2508-163-0x0000000000730000-0x0000000000736000-memory.dmp

Download

memory/2508-170-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3404-321-0x00000000021D0000-0x00000000021D6000-memory.dmp

Download

memory/3404-319-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3404-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3564-117-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3564-126-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3564-119-0x0000000002150000-0x0000000002156000-memory.dmp

Download

memory/4124-486-0x00000000020B0000-0x00000000020B6000-memory.dmp

Download

memory/4124-484-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4216-360-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4216-354-0x00000000022C0000-0x00000000022C6000-memory.dmp

Download

memory/4216-352-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4796-387-0x0000000000620000-0x0000000000626000-memory.dmp

Download

memory/4796-3-0x00007FFE2F2D0000-0x00007FFE2F4C5000-memory.dmp

Download

memory/4796-385-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4796-393-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4796-9-0x0000000077661000-0x0000000077781000-memory.dmp

Download

memory/4932-288-0x0000000000720000-0x0000000000726000-memory.dmp

Download

memory/4932-286-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4932-294-0x0000000000400000-0x0000000000460000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads