Overview

overview

10

Static

static

3

ed85b2c508...ab.exe

windows7-x64

5

ed85b2c508...ab.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    2s
  • max time network
    59s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2025, 20:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe

  • Size

    372KB

  • MD5

    9ddc44a5c178dd4373d2783205f5bb7e

  • SHA1

    fdc28a7ba32079ac97117794960c3e73a8e1bc80

  • SHA256

    ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab

  • SHA512

    1708cc48e42d6d1f6abbdb8bc904aa4df35d1968116806f2e375ba0e77a7e9c5cf0709a4c5b897a5bd0ecd3bf781720edd6323926e67198858349862bcad6bab

  • SSDEEP

    6144:t8dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC+:t2qQx+H2i+8LBNbdypazCXY0

Score
10/10
remcostinodiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Version

2.4.3 Pro

Botnet

TINo

C2

185.140.53.140:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    true

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-5S9O07

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
    "C:\Users\Admin\AppData\Local\Temp\ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5284
    • C:\Users\Admin\AppData\Local\Temp\ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
      "C:\Users\Admin\AppData\Local\Temp\ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5456
      • C:\Users\Admin\AppData\Local\Temp\hab.exe
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5188
        • C:\Users\Admin\AppData\Local\Temp\hab.exe
          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies WinLogon
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3040
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3332
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Windows\system32\wscript.exe
      wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Users\Admin\AppData\Local\Temp\hab.exe
        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1040
        • C:\Users\Admin\AppData\Local\Temp\hab.exe
          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4844
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
            5⤵
              PID:6048
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2952
          • C:\Users\Admin\AppData\Local\Temp\hab.exe
            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
            4⤵
              PID:4908
              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                5⤵
                  PID:4512
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                    6⤵
                      PID:3476
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
            1⤵
              PID:3360
              • C:\Windows\system32\wscript.exe
                wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                2⤵
                  PID:944
                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                    3⤵
                      PID:3732
                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                        4⤵
                          PID:1168
                          • C:\Windows\SysWOW64\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                            5⤵
                              PID:5256
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                      1⤵
                        PID:5184
                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                          2⤵
                            PID:3152
                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                              3⤵
                                PID:3624
                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                  4⤵
                                    PID:4256
                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                      5⤵
                                        PID:3928
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                1⤵
                                  PID:2712
                                  • C:\Windows\system32\wscript.exe
                                    wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                    2⤵
                                      PID:4960
                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                        3⤵
                                          PID:4108
                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                            4⤵
                                              PID:5748
                                              • C:\Windows\SysWOW64\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                5⤵
                                                  PID:6008
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                          1⤵
                                            PID:5324
                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                              2⤵
                                                PID:5760
                                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                  C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                  3⤵
                                                    PID:5108
                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                      4⤵
                                                        PID:5616
                                                        • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                          5⤵
                                                            PID:1552
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                    1⤵
                                                      PID:4092
                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                        2⤵
                                                          PID:4476
                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                            3⤵
                                                              PID:5636
                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                4⤵
                                                                  PID:3156
                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                    5⤵
                                                                      PID:5344
                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                        6⤵
                                                                          PID:2512
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                1⤵
                                                                  PID:1496
                                                                  • C:\Windows\system32\wscript.exe
                                                                    wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                    2⤵
                                                                      PID:4992
                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                        3⤵
                                                                          PID:2756
                                                                          • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                            4⤵
                                                                              PID:5956
                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                5⤵
                                                                                  PID:5520
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                          1⤵
                                                                            PID:5792
                                                                            • C:\Windows\system32\wscript.exe
                                                                              wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                              2⤵
                                                                                PID:5056
                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                  3⤵
                                                                                    PID:3220
                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                      4⤵
                                                                                        PID:2172
                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                                          5⤵
                                                                                            PID:4164
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                    1⤵
                                                                                      PID:5508
                                                                                      • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                        C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                        2⤵
                                                                                          PID:5468
                                                                                          • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                            C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                            3⤵
                                                                                              PID:4640
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                          1⤵
                                                                                            PID:5784
                                                                                            • C:\Windows\system32\wscript.exe
                                                                                              wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                              2⤵
                                                                                                PID:4852
                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                  3⤵
                                                                                                    PID:5668
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                      4⤵
                                                                                                        PID:4844
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                  1⤵
                                                                                                    PID:2536
                                                                                                    • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                      2⤵
                                                                                                        PID:4900
                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                          3⤵
                                                                                                            PID:5728
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                        1⤵
                                                                                                          PID:4876
                                                                                                          • C:\Windows\system32\wscript.exe
                                                                                                            wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                            2⤵
                                                                                                              PID:4636
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                3⤵
                                                                                                                  PID:1716
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                    4⤵
                                                                                                                      PID:1940
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                1⤵
                                                                                                                  PID:5652
                                                                                                                  • C:\Windows\system32\wscript.exe
                                                                                                                    wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                    2⤵
                                                                                                                      PID:5428
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                        3⤵
                                                                                                                          PID:2260
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                      1⤵
                                                                                                                        PID:544
                                                                                                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                          2⤵
                                                                                                                            PID:3924
                                                                                                                            • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                              3⤵
                                                                                                                                PID:2024
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:1616
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                      5⤵
                                                                                                                                        PID:2732
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                                1⤵
                                                                                                                                  PID:5996
                                                                                                                                  • C:\Windows\system32\wscript.exe
                                                                                                                                    wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                                    2⤵
                                                                                                                                      PID:5768
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:4996
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                                      1⤵
                                                                                                                                        PID:6052
                                                                                                                                        • C:\Windows\system32\wscript.exe
                                                                                                                                          wscript "C:\Users\Admin\AppData\Local\Temp\hab.vbs"
                                                                                                                                          2⤵
                                                                                                                                            PID:4156
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\hab.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:3228
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                                                                                                                            1⤵
                                                                                                                                              PID:2212
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:5000
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2824

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.exe
                                                                                                                                                  Filesize

                                                                                                                                                  372KB

                                                                                                                                                  MD5

                                                                                                                                                  b749861c61359bfb05276610b11a95a8

                                                                                                                                                  SHA1

                                                                                                                                                  e7fbc55f75c67cdfc1b650810abd9c04ef830f88

                                                                                                                                                  SHA256

                                                                                                                                                  8d6a17ea27483139cd8bb69361f980d8368c8ba7cc075542ca299d0ee13ad44a

                                                                                                                                                  SHA512

                                                                                                                                                  eb63827587c7b691a619108700ceebd7fde7f4e47bbd1742e565e0c1bf8bb68f2d1e6066adfe8c2aa013fec8e3863a9444144b60328302f6bdd741abf87f0e3f

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hab.vbs
                                                                                                                                                  Filesize

                                                                                                                                                  92B

                                                                                                                                                  MD5

                                                                                                                                                  924c10de3467040c668a0c01b7b3f6b7

                                                                                                                                                  SHA1

                                                                                                                                                  24e7f554808c9047bd74448023727aeffafd5ba9

                                                                                                                                                  SHA256

                                                                                                                                                  0045a1cae6a54111951d5f03d8843e250001405742937683744bec9afb4ff0f4

                                                                                                                                                  SHA512

                                                                                                                                                  feaa18c4c36c54e3bfba5a8c4b57f7088ad05887b91f1a6384af5ea2c54cb39ebd7930b4e6e23ddc18938ff0f4c041083dbe03362c8811c2d0274002459578f0

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\install.vbs
                                                                                                                                                  Filesize

                                                                                                                                                  536B

                                                                                                                                                  MD5

                                                                                                                                                  b4118bddcc9fe0ae73396b2b1b58c970

                                                                                                                                                  SHA1

                                                                                                                                                  23afa06fa78bbcc9c11e8549681fd4956f9d6c45

                                                                                                                                                  SHA256

                                                                                                                                                  e5d5005f7c9fdada426273f14e2ebe328b84f9161e80acc1396dadbe9897e98f

                                                                                                                                                  SHA512

                                                                                                                                                  fdc29fb8fafb990e52487b9ec22140dcbc8c684efa53da41e348584c623fff1a7ce1a9b3deaccdb25867479b393d52d199c8f09cb365e6c84e5980f6d4285b67

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Windows\win.ini
                                                                                                                                                  Filesize

                                                                                                                                                  123B

                                                                                                                                                  MD5

                                                                                                                                                  6bf517432f65eb7f0d18d574bf14124c

                                                                                                                                                  SHA1

                                                                                                                                                  5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

                                                                                                                                                  SHA256

                                                                                                                                                  6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

                                                                                                                                                  SHA512

                                                                                                                                                  7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

                                                                                                                                                  Download Submit

                                                                                                                                                • memory/1168-121-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1168-139-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1168-123-0x0000000002A20000-0x0000000002A26000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1552-210-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1552-212-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1552-214-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2172-246-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2172-231-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2172-233-0x0000000002240000-0x0000000002246000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3040-47-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3040-32-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3040-34-0x0000000002040000-0x0000000002046000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3928-238-0x0000000002140000-0x0000000002146000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3928-236-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3928-241-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4512-106-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4512-92-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4512-94-0x00000000020C0000-0x00000000020C6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4844-76-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4844-68-0x00000000006A0000-0x00000000006A6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4844-66-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5284-4-0x00000000771C1000-0x00000000772E1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                  Download

                                                                                                                                                • memory/5284-9-0x0000000002310000-0x0000000002316000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5284-2-0x0000000002310000-0x0000000002316000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5344-287-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5344-277-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5344-279-0x0000000000730000-0x0000000000736000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5456-12-0x0000000002B20000-0x0000000002B26000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5748-159-0x0000000002A30000-0x0000000002A36000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5748-157-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5748-176-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5956-201-0x0000000001FC0000-0x0000000001FC6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5956-216-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5956-199-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  384KB

                                                                                                                                                  Download