Overview

overview

10

Static

static

3

481841aebb...37.exe

windows7-x64

10

481841aebb...37.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    2s
  • max time network
    60s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2025, 20:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    481841aebb41952021b31d784769bf7d534c0a9e82f7c1ca12eed710e9ceba37.exe

  • Size

    372KB

  • MD5

    bda6a831048a75f25e8ffa55a9418bf7

  • SHA1

    756c3237c1f793766b169129181167c328e697d9

  • SHA256

    481841aebb41952021b31d784769bf7d534c0a9e82f7c1ca12eed710e9ceba37

  • SHA512

    16fbada2e7e678e9ae0d642d359946088a841c98741b031108519bc893b6bcc624d97f81402d663c5c191eaac8b4d097f845a96107475ac8ad03adfc099eb3ca

  • SSDEEP

    6144:tIdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiuK:tSqQx+H2i+8LBNbdypazCXYY

Score
10/10
remcostinodiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

TINo

C2

185.140.53.140:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    true

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-5S9O07

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\481841aebb41952021b31d784769bf7d534c0a9e82f7c1ca12eed710e9ceba37.exe
    "C:\Users\Admin\AppData\Local\Temp\481841aebb41952021b31d784769bf7d534c0a9e82f7c1ca12eed710e9ceba37.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5216
    • C:\Users\Admin\AppData\Local\Temp\481841aebb41952021b31d784769bf7d534c0a9e82f7c1ca12eed710e9ceba37.exe
      "C:\Users\Admin\AppData\Local\Temp\481841aebb41952021b31d784769bf7d534c0a9e82f7c1ca12eed710e9ceba37.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Users\Admin\AppData\Local\Temp\hab.exe
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4660
        • C:\Users\Admin\AppData\Local\Temp\hab.exe
          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies WinLogon
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4928
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4888
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\Windows\system32\wscript.exe
      wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Users\Admin\AppData\Local\Temp\hab.exe
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\Users\Admin\AppData\Local\Temp\hab.exe
          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies WinLogon
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:64
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
            5⤵
              PID:3700
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5012
        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2384
          • C:\Users\Admin\AppData\Local\Temp\hab.exe
            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
            4⤵
              PID:2164
              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                5⤵
                  PID:3992
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                    6⤵
                      PID:4248
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
            1⤵
              PID:1132
              • C:\Windows\system32\wscript.exe
                wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                2⤵
                  PID:2072
                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                    3⤵
                      PID:2272
                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                        4⤵
                          PID:3276
                          • C:\Windows\SysWOW64\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                            5⤵
                              PID:1744
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                      1⤵
                        PID:6136
                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                          2⤵
                            PID:5280
                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                              3⤵
                                PID:3168
                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                  4⤵
                                    PID:4584
                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                      5⤵
                                        PID:1592
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                          6⤵
                                            PID:2112
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                  1⤵
                                    PID:5312
                                    • C:\Windows\system32\wscript.exe
                                      wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                      2⤵
                                        PID:5276
                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                          3⤵
                                            PID:1476
                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                              4⤵
                                                PID:1416
                                                • C:\Windows\SysWOW64\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                  5⤵
                                                    PID:5644
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                            1⤵
                                              PID:3228
                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                2⤵
                                                  PID:2424
                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                    3⤵
                                                      PID:3924
                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                        4⤵
                                                          PID:3484
                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                            5⤵
                                                              PID:4232
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                      1⤵
                                                        PID:2540
                                                        • C:\Windows\system32\wscript.exe
                                                          wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                          2⤵
                                                            PID:5784
                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                              3⤵
                                                                PID:4156
                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                  4⤵
                                                                    PID:2288
                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                      5⤵
                                                                        PID:1060
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                1⤵
                                                                  PID:1900
                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                    2⤵
                                                                      PID:5656
                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                        3⤵
                                                                          PID:3928
                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                            4⤵
                                                                              PID:4708
                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                5⤵
                                                                                  PID:4840
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                          1⤵
                                                                            PID:2956
                                                                            • C:\Windows\system32\wscript.exe
                                                                              wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                              2⤵
                                                                                PID:3572
                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                  3⤵
                                                                                    PID:5508
                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                      4⤵
                                                                                        PID:5092
                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                          5⤵
                                                                                            PID:5504
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                    1⤵
                                                                                      PID:568
                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                        2⤵
                                                                                          PID:4388
                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                            3⤵
                                                                                              PID:4844
                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                4⤵
                                                                                                  PID:5888
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                    5⤵
                                                                                                      PID:4236
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                              1⤵
                                                                                                PID:3140
                                                                                                • C:\Windows\system32\wscript.exe
                                                                                                  wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                  2⤵
                                                                                                    PID:2052
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                      3⤵
                                                                                                        PID:3344
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                          4⤵
                                                                                                            PID:5164
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                      1⤵
                                                                                                        PID:4924
                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                          2⤵
                                                                                                            PID:4872
                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                              3⤵
                                                                                                                PID:6092
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                            1⤵
                                                                                                              PID:4820
                                                                                                              • C:\Windows\system32\wscript.exe
                                                                                                                wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                2⤵
                                                                                                                  PID:1140
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                    3⤵
                                                                                                                      PID:2532
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                        4⤵
                                                                                                                          PID:4604
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                    1⤵
                                                                                                                      PID:4548
                                                                                                                      • C:\Windows\system32\wscript.exe
                                                                                                                        wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                        2⤵
                                                                                                                          PID:3156
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                            3⤵
                                                                                                                              PID:5912
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                          1⤵
                                                                                                                            PID:3808
                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                              2⤵
                                                                                                                                PID:1216
                                                                                                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:4412
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                                1⤵
                                                                                                                                  PID:1924
                                                                                                                                  • C:\Windows\system32\wscript.exe
                                                                                                                                    wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                                    2⤵
                                                                                                                                      PID:5860
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:6072
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                      1⤵
                                                                                                                                        PID:4456
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:3120
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                              3⤵
                                                                                                                                                PID:1424
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                                            1⤵
                                                                                                                                              PID:2960
                                                                                                                                              • C:\Windows\system32\wscript.exe
                                                                                                                                                wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                                                2⤵
                                                                                                                                                  PID:5840
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2104

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                  Filesize

                                                                                                                                                  372KB

                                                                                                                                                  MD5

                                                                                                                                                  46f04f1d86c37dc9ec80a83316a6b662

                                                                                                                                                  SHA1

                                                                                                                                                  032fbdaf6d88266da413dc53288f6295f44cd725

                                                                                                                                                  SHA256

                                                                                                                                                  4ac1bfa758b5b71d6f4b2fef14b7afdf6a31cb0c7eafbb1454346e29dc4c0e29

                                                                                                                                                  SHA512

                                                                                                                                                  420b77a7b457d290837d3bbd8b09d277ffbd1578f85f6bee59e78d6393af6bc29ad6973c4ddee40521c24e83153cd7607262793767fbd89d69cb886e6b548824

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.vbs
                                                                                                                                                  Filesize

                                                                                                                                                  92B

                                                                                                                                                  MD5

                                                                                                                                                  924c10de3467040c668a0c01b7b3f6b7

                                                                                                                                                  SHA1

                                                                                                                                                  24e7f554808c9047bd74448023727aeffafd5ba9

                                                                                                                                                  SHA256

                                                                                                                                                  0045a1cae6a54111951d5f03d8843e250001405742937683744bec9afb4ff0f4

                                                                                                                                                  SHA512

                                                                                                                                                  feaa18c4c36c54e3bfba5a8c4b57f7088ad05887b91f1a6384af5ea2c54cb39ebd7930b4e6e23ddc18938ff0f4c041083dbe03362c8811c2d0274002459578f0

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\install.vbs
                                                                                                                                                  Filesize

                                                                                                                                                  536B

                                                                                                                                                  MD5

                                                                                                                                                  b4118bddcc9fe0ae73396b2b1b58c970

                                                                                                                                                  SHA1

                                                                                                                                                  23afa06fa78bbcc9c11e8549681fd4956f9d6c45

                                                                                                                                                  SHA256

                                                                                                                                                  e5d5005f7c9fdada426273f14e2ebe328b84f9161e80acc1396dadbe9897e98f

                                                                                                                                                  SHA512

                                                                                                                                                  fdc29fb8fafb990e52487b9ec22140dcbc8c684efa53da41e348584c623fff1a7ce1a9b3deaccdb25867479b393d52d199c8f09cb365e6c84e5980f6d4285b67

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\win.ini
                                                                                                                                                  Filesize

                                                                                                                                                  123B

                                                                                                                                                  MD5

                                                                                                                                                  6bf517432f65eb7f0d18d574bf14124c

                                                                                                                                                  SHA1

                                                                                                                                                  5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

                                                                                                                                                  SHA256

                                                                                                                                                  6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

                                                                                                                                                  SHA512

                                                                                                                                                  7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

                                                                                                                                                  Download Submit

                                                                                                                                                • memory/64-72-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/64-63-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/64-65-0x00000000028B0000-0x00000000028B6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1416-193-0x00000000021E0000-0x00000000021E6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1416-192-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1416-213-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1508-12-0x0000000001FC0000-0x0000000001FC6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1592-157-0x0000000000660000-0x0000000000666000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1592-175-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1592-156-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2288-223-0x00000000006D0000-0x00000000006D6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2288-222-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2288-231-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3276-119-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3276-117-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3276-135-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3992-97-0x00000000028A0000-0x00000000028A6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3992-109-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3992-96-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4232-199-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4232-209-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4232-203-0x0000000000620000-0x0000000000626000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4840-248-0x0000000000720000-0x0000000000726000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4840-246-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4840-250-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4928-34-0x00000000021D0000-0x00000000021D6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4928-45-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4928-32-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5092-238-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5092-256-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5216-2-0x0000000002BE0000-0x0000000002BE6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5216-9-0x0000000002BE0000-0x0000000002BE6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5216-4-0x0000000077601000-0x0000000077721000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                  Download