remcos | 0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
Size 880KB
Sample260727-a5kphatdnd
SHA256 0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1
MD5 3af35d3de456d9e1c1b9d6e233298944
SHA1 4e35d3a590af24c8710343d47e306b9194209389
SHA512 038f8504e04a9c593cf91e5f44263e4af7e639224271b7242fe22cff5caab234ff48542ee004572a5cdebcaa6df109512d7a168800cdaab5828109282b8055e2
SSDEEP 24576:1A7FHfbC4WEAXf6lMeBEFmNZpJGSqQc3DKtbPik+B:1S2EzrDHVSKtTik+B
TLSH
T151152349B3358B1FE859E370D87A8B64CB7CAD687406570F634572AA3C632CA05253FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos installer persistence rat

Malware Config

Extracted

Family

remcos

Version

7.1.0 Pro

Botnet

RemoteHost

31.57.216.56:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-XL2DMU
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe

Executes dropped EXE 3 IoCs

pid	Process
5288	remcos.exe
4548	remcos.exe
2636	remcos.exe

Loads dropped DLL 64 IoCs

pid	Process
3312	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
3312	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
5288	remcos.exe
5288	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
3872	remcos.exe
5236	remcos.exe
5568	remcos.exe
5032	remcos.exe
5992	remcos.exe
4800	remcos.exe
3316	remcos.exe
4972	remcos.exe
3288	remcos.exe
4176	remcos.exe
4720	remcos.exe
4984	remcos.exe
5036	remcos.exe
4116	remcos.exe
1780	remcos.exe
3056	remcos.exe
5636	remcos.exe
5080	remcos.exe
4072	remcos.exe
2440	remcos.exe
5092	remcos.exe
4836	remcos.exe
5616	remcos.exe
812	remcos.exe
740	remcos.exe
5168	remcos.exe
1988	remcos.exe
4180	remcos.exe
5576	remcos.exe
2244	remcos.exe
4184	remcos.exe
4044	remcos.exe
5656	remcos.exe
3344	remcos.exe
5320	remcos.exe
5328	remcos.exe
3068	remcos.exe
4856	remcos.exe
5440	remcos.exe
5368	remcos.exe
5408	remcos.exe
2500	remcos.exe
464	remcos.exe
2404	remcos.exe
5448	remcos.exe
1520	remcos.exe
6024	remcos.exe
1544	remcos.exe
1240	remcos.exe
5740	remcos.exe
1640	remcos.exe
4032	remcos.exe
4916	remcos.exe
3880	remcos.exe
3780	remcos.exe
4348	remcos.exe
4728	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-XL2DMU = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-XL2DMU = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	drive.google.com
11	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4656	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3312	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
4656	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
5288	remcos.exe
956	remcos.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\slagterknive\kofferdammens.ini	remcos.exe
File opened for modification	C:\Windows\resources\0409\slagterknive\kofferdammens.ini	remcos.exe
File opened for modification	C:\Windows\resources\0409\slagterknive\kofferdammens.ini	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000a000000024667-594.dat	nsis_installer_1
behavioral1/files/0x000a000000024667-594.dat	nsis_installer_2

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3312	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
5288	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe
956	remcos.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 3996	3312	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe	88
PID 3312 wrote to memory of 4656	3312	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe	89
PID 3312 wrote to memory of 4656	3312	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe	89
PID 4656 wrote to memory of 3628	4656	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe	90
PID 4656 wrote to memory of 5288	4656	0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe	93
PID 5288 wrote to memory of 4548	5288	remcos.exe	94
PID 5288 wrote to memory of 956	5288	remcos.exe	95
PID 5288 wrote to memory of 956	5288	remcos.exe	95
PID 956 wrote to memory of 2636	956	remcos.exe	107
PID 956 wrote to memory of 3872	956	remcos.exe	108
PID 956 wrote to memory of 5236	956	remcos.exe	109
PID 956 wrote to memory of 5568	956	remcos.exe	110
PID 956 wrote to memory of 5032	956	remcos.exe	111
PID 956 wrote to memory of 5992	956	remcos.exe	112
PID 956 wrote to memory of 4800	956	remcos.exe	113
PID 956 wrote to memory of 3316	956	remcos.exe	114
PID 956 wrote to memory of 4972	956	remcos.exe	115
PID 956 wrote to memory of 3288	956	remcos.exe	116
PID 956 wrote to memory of 4176	956	remcos.exe	117
PID 956 wrote to memory of 4720	956	remcos.exe	118
PID 956 wrote to memory of 4984	956	remcos.exe	119
PID 956 wrote to memory of 5036	956	remcos.exe	120
PID 956 wrote to memory of 4116	956	remcos.exe	121
PID 956 wrote to memory of 1780	956	remcos.exe	122
PID 956 wrote to memory of 3056	956	remcos.exe	123
PID 956 wrote to memory of 5636	956	remcos.exe	124
PID 956 wrote to memory of 5080	956	remcos.exe	125
PID 956 wrote to memory of 4072	956	remcos.exe	126
PID 956 wrote to memory of 2440	956	remcos.exe	127
PID 956 wrote to memory of 5092	956	remcos.exe	128
PID 956 wrote to memory of 4836	956	remcos.exe	129
PID 956 wrote to memory of 5616	956	remcos.exe	130
PID 956 wrote to memory of 812	956	remcos.exe	131
PID 956 wrote to memory of 740	956	remcos.exe	132
PID 956 wrote to memory of 5168	956	remcos.exe	133
PID 956 wrote to memory of 1988	956	remcos.exe	134
PID 956 wrote to memory of 4180	956	remcos.exe	135
PID 956 wrote to memory of 5576	956	remcos.exe	136
PID 956 wrote to memory of 2244	956	remcos.exe	137
PID 956 wrote to memory of 4184	956	remcos.exe	138
PID 956 wrote to memory of 4044	956	remcos.exe	139
PID 956 wrote to memory of 5656	956	remcos.exe	140
PID 956 wrote to memory of 3344	956	remcos.exe	141
PID 956 wrote to memory of 5320	956	remcos.exe	142
PID 956 wrote to memory of 5328	956	remcos.exe	143
PID 956 wrote to memory of 3068	956	remcos.exe	144
PID 956 wrote to memory of 4856	956	remcos.exe	145
PID 956 wrote to memory of 5440	956	remcos.exe	146
PID 956 wrote to memory of 5368	956	remcos.exe	147
PID 956 wrote to memory of 5408	956	remcos.exe	148
PID 956 wrote to memory of 2500	956	remcos.exe	149
PID 956 wrote to memory of 464	956	remcos.exe	150
PID 956 wrote to memory of 2404	956	remcos.exe	151
PID 956 wrote to memory of 5448	956	remcos.exe	152
PID 956 wrote to memory of 1520	956	remcos.exe	153
PID 956 wrote to memory of 6024	956	remcos.exe	154
PID 956 wrote to memory of 1544	956	remcos.exe	155
PID 956 wrote to memory of 1240	956	remcos.exe	156
PID 956 wrote to memory of 5740	956	remcos.exe	157
PID 956 wrote to memory of 1640	956	remcos.exe	158
PID 956 wrote to memory of 4032	956	remcos.exe	159
PID 956 wrote to memory of 4916	956	remcos.exe	160
PID 956 wrote to memory of 3880	956	remcos.exe	161
PID 956 wrote to memory of 3780	956	remcos.exe	162

C:\Users\Admin\AppData\Local\Temp\0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
"C:\Users\Admin\AppData\Local\Temp\0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Users\Admin\AppData\Local\Temp\0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
  "C:\Users\Admin\AppData\Local\Temp\0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe"
  2⤵
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
  "C:\Users\Admin\AppData\Local\Temp\0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Local\Temp\0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
    "C:\Users\Admin\AppData\Local\Temp\0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe"
    3⤵
    PID:3628
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5288
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:4548
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:956
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Executes dropped EXE
        
        PID:2636
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:3872
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5236
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5568
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5032
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5992
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4800
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:3316
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4972
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:3288
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4176
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4720
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4984
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5036
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4116
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:1780
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:3056
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5636
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5080
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4072
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:2440
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5092
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4836
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5616
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:812
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:740
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5168
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:1988
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4180
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5576
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:2244
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4184
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4044
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5656
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:3344
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5320
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5328
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:3068
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4856
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5440
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5368
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5408
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:2500
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:464
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:2404
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5448
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:1520
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:6024
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:1544
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:1240
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:5740
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:1640
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4032
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4916
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:3880
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:3780
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4348
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Loads dropped DLL
        
        PID:4728
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5924
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:3792
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:4124
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1040
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5648
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5696
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:3776
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:4936
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1108
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:3756
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2176
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5952
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5116
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:4200
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1028
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:3816
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5600
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5604
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:3408
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:3376
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:880
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2444
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5640
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5492
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5484
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1892
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:3916
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2312
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5760
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:6104
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5968
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5488
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1080
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1724
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:3484
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5672
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2132
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5612
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5280
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:700
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1548
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5284
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2024
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5056
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2476
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:4052
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5680
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:3060
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5200
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:4944
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5852
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1488
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2876
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5920
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1528
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1312
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2460
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5768
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5756
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2956
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:804
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:4864
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5788
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:6132
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5804
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2672
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:4100
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2200
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:1512
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:2032
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:5676
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:4036
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:692
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:208
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        
        PID:100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 880KB
SHA256 0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1
MD5 3af35d3de456d9e1c1b9d6e233298944
SHA1 4e35d3a590af24c8710343d47e306b9194209389
SHA512 038f8504e04a9c593cf91e5f44263e4af7e639224271b7242fe22cff5caab234ff48542ee004572a5cdebcaa6df109512d7a168800cdaab5828109282b8055e2
SSDEEP 24576:1A7FHfbC4WEAXf6lMeBEFmNZpJGSqQc3DKtbPik+B:1S2EzrDHVSKtTik+B
TLSH
T151152349B3358B1FE859E370D87A8B64CB7CAD687406570F634572AA3C632CA05253FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsd59D7.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd59D7.tmp
Size 32B
SHA256 614525072841d7562c16ea46239677d54642ee09bfd61ff34acf7b241e932b6d
MD5 17f7d2a7706626717a33711e85def73b
SHA1 7f211cb439742fd21ed1eaccd212bceb768e80eb
SHA512 77506e6edd93e7f2243579a1d4babe11b2c5a54d3b6ed06779a8171f38a19a5e9c6f4202a8315edb28a654020647a4475c3bd95d9c7a97eec6e097ec42ea9584
MD5 SHA1 SHA512

Submit Download

nsd5A75.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd5A75.tmp
Size 26B
SHA256 83983d38dc78bc956b05e5e3853110c2f1ffbdefab91118ca4aa3023a8e36d83
MD5 bb2040a7d22db0fa3da08699cd798bc4
SHA1 3a51ba205c195a4428fe8b826e4c2748815e907a
SHA512 9bfcb06ec8e0ab8f080f025e9f6cc7b7757ada0689331cd4112fc2c9a0c17d987af6d0cdde05f8a1d97de4b219e04b04c45cb663b0d44bf2b241024ed220ba12
MD5 SHA1 SHA512

Submit Download

nsg79F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg79F1.tmp
Size 42B
SHA256 5e8f7f2bad61bc10fa2f647e1367a29053166799244128a74508cc3c3a760c08
MD5 a736abcb9380cc3122c530302f713c8b
SHA1 04b4d0d386bd0ade20409730e8160c5c713fb36b
SHA512 234d99b774a992d86762c9d298dc62d612219234db760a259d6e21ed9d1f10dd810aefb4d9c82af254ceb7d64ff2811772dfc4350ccdfd4375f01a7b801cc333
MD5 SHA1 SHA512

Submit Download

nsg79F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg79F1.tmp
Size 43B
SHA256 5c9b9d544efddd32a858390c7f0f7123f4b06e201de44f6e59397d49bac23f42
MD5 861b54f1598ea66927bfe815c60b07bf
SHA1 05ed884e4bbf1b3f5564849ea66130977618f482
SHA512 ff5b0a987698f4510e63d63ab6ee8738deda76b8b858d989b951918ee388f63519528afd76e521c16b0e8559939c184e05cb1be33fb4af49e026cb27c57fdd1b
MD5 SHA1 SHA512

Submit Download

nsi5959.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsi5959.tmp
Size 51B
SHA256 15f6b52edd0bf33f8fbc357d9fdc3287d97e51227eeb0a21dc58a3337d9fa692
MD5 b61b2f1546b29486a8a0d25e1cba7721
SHA1 c19a4677b46a71e1624d77b3af0af2411c57f6b1
SHA512 429c3b7917cd2ef31765683ac06f434aa5081e0113ccad168312a696e3c66ba36834113068f6ef2e291918db80617d347ea1f5c81c32b0f17702925407779cd2
TLSH
T10690022306115E69B8C7859748695555520A655599510495159409452542056CA8B285
MD5 SHA1 SHA512 TLSH

Submit Download

nsn1962.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsn1962.tmp
Size 50B
SHA256 6a3fde98ef05ef8b76bb66538de3e3e14b6d9928176532293645b0cb27325c9d
MD5 66232700b45a0cd2fca0b0ab4c15cf1d
SHA1 5b63ae813636c07f4de62f88425d23c3c75e024b
SHA512 f97a2e4779c99d335f4118b94dfb004c65efe5342c6fc75632bfa6f96ac14c5c35cd1adc11a7e5472dc22553e6151e109e2cca5694139eea6fa32e620c0c5054
TLSH
T19A90022306115E6978C7859348695555520A645599510495159409452542056CA8B285
MD5 SHA1 SHA512 TLSH

Submit Download

nsn1962.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsn1962.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsn19B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsn19B1.tmp
Size 40B
SHA256 cec044d2e064d5582b41836e63f1a994fdae6c09adf4ee0c9b12cd4d9f37a27f
MD5 60b2de81bdd174a66a030b718da860d2
SHA1 136edc8792ffc31a4ec82da989a5b5793c710aef
SHA512 11132f39abc6edd8e4954f249a867f1a0080ee3c324c8b852df3efd8044de7522ffa4ddd4ecf77d5505e04ecc5ba9079f1eee29e37c5fc94acff073ea1b5ac30
MD5 SHA1 SHA512

Submit Download

nsn19B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsn19B1.tmp
Size 47B
SHA256 7e157ff27de4728262e64f617c019b123870778c352d91752d98f0cca65ea864
MD5 5262fd27e6cafbb28017dc6eee6c8fe0
SHA1 c016bdf7825a49417d18b8b05ab6d29861eea42e
SHA512 21d253971415410eb1a46682f32aaccdebd2a444bcf20e86f004fae991cbb5756f2f1afdfd0a042d57d45ec004cfb7a6e501933c8cb2b1f402ac978fffe768cf
MD5 SHA1 SHA512

Submit Download

nsn19B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsn19B1.tmp
Size 56B
SHA256 1a27ffbe20732c481dcde51d87418c9d8c0f391974bb57ca338699dc3ad79c54
MD5 de0f40d9a180a627659795ce89a7c3ae
SHA1 245d70686577bb2d55abe4932ee41cae5a96a96a
SHA512 42ad6d0a0f3d40e8fa68f74e3fc7e579a31c865bedb656084eaefe014e76ddb442806b04a4d1c3f88a13bf6bcbae586eda371532eb4f913aea509b3ec56a127d
TLSH
T15D900229525559D0274B85655E31A179531A58740C3504132BAC5941B41710A8253209
MD5 SHA1 SHA512 TLSH

Submit Download

nsn19B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsn19B1.tmp
Size 60B
SHA256 a60360534b5a7966158740177d0a48f1ef430b5bff2af517f8063385ff5de4a0
MD5 8da34f5a804704c03f40cb84a0fe1a2d
SHA1 d2fb667d473f3e11279c0cf23a8132c31664ab50
SHA512 677247b8f81e572d2ecd1f7e30570434ac230b6b3a05c0c4aafa7d3b9219d7a60f379edca674c822365723cb4391f3491e0eff27f24a8199a0593a2e78643f2e
TLSH
T1ABA00229929559D0274B85665E31A179531A68744C7604132BAC6941B41714E8253259
MD5 SHA1 SHA512 TLSH

Submit Download

nsr7B1C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr7B1C.tmp
Size 53B
SHA256 fdfaf7225de9c7da550e76f31c209f580bd771033d3c9b10c5766d8711c2b6d5
MD5 e61dbbcfc9fd5b224cb9c7a063e04adb
SHA1 3049197eda9a71db91ec62bad0034612a547221e
SHA512 3e6116e9907a2b15fe9c2ce82b942671d2ca77ec9f0667984d4afd8e56ee5d0540330e2d34ac9c6040304e542229d660a91b8f28fa7c935c5f0c2423222e3f0f
TLSH
T127900220661579A4A349E4E14C11499A900A5534681A00021665549471464CBC0A6644
MD5 SHA1 SHA512 TLSH

Submit Download

nsr7B6B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr7B6B.tmp
Size 14B
SHA256 97e5daf6f20df9ce038a539d8bcf4d7b9efc1058102c9ce7ce1e6e169200672c
MD5 67bb7ef976d4ce39058a22b6174a0e72
SHA1 9be7c1328a129dfa8fbda22b646e803ff262c5ef
SHA512 12192b1718b77b437b383bca40335944b6bcaa772ccd398eb4b92a5b7882e3159a65470141fb98d7911f96bd97d46e93955302a9f5a19059ebcaa2c1a3f915e1
MD5 SHA1 SHA512

Submit Download

nst1B0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1B0B.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nsv78C6.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv78C6.tmp
Size 21B
SHA256 612365d1000c11e69ee5ecd1faa7dc59078993959c48b7916a580b7bd3cbf587
MD5 8971b7a691c3fa70cb038019ee564845
SHA1 bdffd99c78750e7832d7d1e0cdee6c08c089ecb5
SHA512 ee51ddd485220a130dbd4ae28f47f7bb990ca989deaabd5467b2f446cba05b2e600e1c04414e844c94bdc0b68bdfc2618e8aa410401cbb640c59831b8f9647d9
MD5 SHA1 SHA512

Submit Download

nsw7A9E.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsw7A9E.tmp
Size 36B
SHA256 62902c9dcbcd945b9f4b41f85d97f10d5ffc8b17d515064ac21326fd4b1249f0
MD5 6d5ef126d910979ddd41b3584f31ff00
SHA1 078dd7e70a53e164678c914d3082f4f717fc87bf
SHA512 189082d74bb29e78cc2de4f037f577cb224e53ab93a247740ff49266703f05e91268e402f49cc586c7ed2cc4e8b3e4a98afe5440262c9639fc0786b0dda118b2
MD5 SHA1 SHA512

Submit Download

nsw7A9E.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsw7A9E.tmp
Size 41B
SHA256 439ab322e6c7f9f666df492224c1f4459ba861324d6361785f381d7120b8828e
MD5 f465b8254eff9e8e2f2b322d5bcf02ad
SHA1 464730ea1fba393b71c618ebf393435bfc0e258a
SHA512 efd0375397ae3c687630eb31c3bfd6f3239c4931a2ba341300481bf74ade3340edc30cdabec0959ea4ccea66dd646883bf697d753c9f8173c83e8615bbf85e20
MD5 SHA1 SHA512

Submit Download

nsw7A9E.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsw7A9E.tmp
Size 44B
SHA256 b031e169ad90871cb6a152898dac9bf5f72e73b432898d6af0ed4237e430d605
MD5 0a4d732b2d88423f5a42e91b214e3961
SHA1 f1353cbc46c11b85f1ad1d8bb0bad5f2eaac374a
SHA512 e8e302823118eb72497783b88de7d21e31e5fadb22a312b724f85f4b02530b9c2f0ddaef9ee932bbb12db20441081077931786359a60aa9e1a6d6d76c94b18d0
MD5 SHA1 SHA512

Submit Download

nsx1902.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx1902.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx1903.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsx58CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx58CA.tmp
Size 20B
SHA256 0883f5bab7d5dafd9efec59b917070f5d051f50b047951d1ea87dab27fef7b91
MD5 9111ba1d1ceb4b7f775d74730aac363e
SHA1 c0af4968c775735be12419b60b257ed4359cb9b2
SHA512 836c5d3941109691f2589e317e10d661978d9fc4af435bde3467159913ff9192d6eab1efe3e50e2048d06ce0c85963efe1ac056e1fd6ff1d33ac05f25beabbbf
MD5 SHA1 SHA512

Submit Download

nsx58CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx58CA.tmp
Size 33B
SHA256 0ca259e86b73dc8d2f375e3860b6bf91b78b3680b5b90c262fdd82432492a77a
MD5 5555876f2521b3ae2424dd9d6ce983aa
SHA1 5dd9296584980764dc0bebb55e721e6f9aacc86b
SHA512 71992459867bdb629a697d2f1e750390983fd752fe46f3c753eb0671d8e7498850320145b5662c714229cfcad6f0a2fbffac4c5a6ff40c87a90701bfa69763dd
MD5 SHA1 SHA512

Submit Download

nsx58CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx58CA.tmp
Size 40B
SHA256 b10b2877ad9f4d77d275562f4a233c4d2900e36568d5e1761c3d92b33e050a7a
MD5 28a6676780b5dc10cce96a2b07fd2dce
SHA1 2f49455fac0d2dfa8a3b087dcd14e1c62f97c94b
SHA512 801b2519bc90819eb45aab326909e0a3e83dd3bce7b491f3489b2be4b0d0ef947245d2fbc6fd1702436378e48ec3a6a90f1f6df43684d614aa3fecc40382fca9
MD5 SHA1 SHA512

Submit Download

nsx58CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx58CA.tmp
Size 54B
SHA256 3159fb26988fd82c5a652bdf09e65bb021011a4f8953f009c0a7d893149a9c8e
MD5 8e69760955a717be873f8253ebc6905b
SHA1 c813b0cc54451465777460ef2f46bc98c273c739
SHA512 16de94f841400aeffd2b67ca45e807da10023229f667f746b8fc7b127c347d843ff51b822191e656a94b63d8c8187c928d40113914d34570136c878b64279600
TLSH
T19C90025624814654F582C4711B557008E59D302600C544031A4D44485C05052CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nsx58CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx58CA.tmp
Size 65B
SHA256 2bad3065546719b1e5ff58cb7ca6231b6cb669fb1fd06fb30102e9df00d63e60
MD5 1bd5509d17a385dbcebec5b71de8dffc
SHA1 9d70c3f205dddda5e33e5de97c0a09feb6836130
SHA512 ca43f9d62ad2c3b950b816274869a1c0bd22b77bbb80fc810783ef23b9317362132fb2f29510bb51f4d00940d8c9038b5700560b6f1e38722b2e65037c148bbf
TLSH
T188A00256358156A4FEC2C4711F65700CE59D303600C544032A4D48489D05067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsx58CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx58CA.tmp
Size 66B
SHA256 cc1c32ae1abcb46fd4871832a8b7a51a440905d97709c53e66d16a0cd33276ee
MD5 3a055708070979e7bf5088d9471320ba
SHA1 cb4e803ae05765ee43787cbd3abb91166bbf8fd7
SHA512 3f3b5c9c1fdca9e76fda76ff601d11320b4866ee0b0358b014699e33be79252cb94390fb589fa5099b68d00491a207f3fe6223b955a5a4be6f1df1b389fd613e
TLSH
T17DA00256358156A4FEC2C4711F65700CE59D303600C544032A4D48889D45067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsy19F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsy19F1.tmp
Size 24B
SHA256 3d42f06595afec189d9167ecf58d0da6c8294c155e9fc364d8fe8bdcdf25bc89
MD5 942a0add5de9c46c9874a72eba3ce9f6
SHA1 c51748200f0e8ff506ca5d9878573146be220491
SHA512 1813eba450ea8bb385b0da7ce4b54a196df7d8b8fb8e79ee9a8161aad31ba7e9e082a337e08c5f09aa19d48a19c1d3c20596893017f350dec28bab36b1366800
MD5 SHA1 SHA512

Submit Download

nsy19F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsy19F1.tmp
Size 56B
SHA256 3d241a858189b4e379d0902cb349154eb62934eb1734531d6f539cbb6470502c
MD5 b55f9749122c7921cbdacf88b5ffcce0
SHA1 7e62b6cb7a6329aa18b666eb67294b3c2399571a
SHA512 15465fd9cf7fd59716124790d0d952dc13af1b0fb1950997e8db3f3df31d30d00a01359abfe5e1ff815da2543467bd5a578e20eca7d3729bb12c4132c13c6598
TLSH
T100900224665579A4E34AE8E54C11499A910A5634681B00021665549471464CBC4A6644
MD5 SHA1 SHA512 TLSH

Submit Download

mallorcinernes.jpg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\undervisningscentrene\annuity\Commentarial\mallorcinernes.jpg
Size 3KB
SHA256 6bfc95e4e5815a73c86df6990317ecad7b2cb6b406af63d88ccc325542cdc594
MD5 c5367038f0e55019103d2f2a5941fe68
SHA1 d16185f48f35ff3ac5833f9fb0c57620e769aa6e
SHA512 d24d2c21c0bc20021772ab3e5013ce7183f554d5511c9081c90e875094abd9566e844568e4631f1badccb4e4688c062ab10a5f2fabc0da3c78c8acb145c11d01
TLSH
T1F7518D6FEF50E2024F5608F5154C3A4358038AA039F07A780970A549CBE0D7CAA5BEAE
MD5 SHA1 SHA512 TLSH

Submit Download

thetch.und

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\undervisningscentrene\annuity\Commentarial\thetch.und
Size 7.4MB
SHA256 ee8a49c485efd1fd35b7041274f634fe7eb738f4fd242ac04dd50bee0b216113
MD5 9c4b25e49e51a4bf948dc2c1f7a7e8c6
SHA1 2ddefba6365f5b720fb1cb367b91e310716a6a5c
SHA512 7099a4d5d02c6e46c37dd9e434e9caa912abddb8207ac7173985d144d0077cbcc94d3e3952d0cfc4e88a1bcfe5d955b193db2f52aae42c44420c9c2039761cd5
SSDEEP 384:G3PZRywigU0iwuV0scD6L+NNdvLtBUJE7APTJQuMj1Ef5GuHevnvk/HHNQrt7Mt3:iaiTr8iyN/lYe
TLSH
T1BA76233787094283EA21555B3D8E83EDC3E57EF6A6098D231EC5FA8BE5595313F2102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egenses.jpg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\undervisningscentrene\annuity\Egenses.jpg
Size 20KB
SHA256 ea9382aa8777538c7f6bd79540ac93a0109839ba9ee9d5a03fe0dd55c28a3184
MD5 f2ff221ffc0d415c336628526dccb7d9
SHA1 a878667ec88e06d5edc0b73dc8e13c79b45fdc67
SHA512 9569a7e1444b0a71a1f56702d29d864695816b7301b5b61048d0e2e95a592d14f205daa131d74616266d72cd760946b8c58d140e971dda51762547f46b6f8ebb
SSDEEP 384:EjUHvZNaEqRmtchfyP8AKNynJOOMsVb2VZm/7z0ov0sBWmV4zme4Aprp:EjUPWEqRvhfXUJqaAckocTmV4qeFt
TLSH
T1BAA2E1AA370D69A0AF7212B82FCC63B8E68C47B85251ECBD153557E3F348D76C8456A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mnttelefoner41.jpg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\undervisningscentrene\annuity\Mnttelefoner41.jpg
Size 98KB
SHA256 aff48351891c99bfc9e145d0a13d4a0e56a9976adc657cde0937942620501cdf
MD5 40e1f9a46b0ecad0efa46150547938bc
SHA1 1ea39d1dd2accf14a3dd0d75e61040ea81626e9e
SHA512 d3339ee47a5418f01133112b4a600bf1832d63ac5acd998ae4cd88991358b742365b2a4322a6c0fa29149e29ed8e68c7eb5a6b0ff904bda9194d92eca86962cf
SSDEEP 3072:jlihS7kOztKtzWCRbRxv3XnDY5h9R6ckg:jEGK8CRfTM9r
TLSH
T15AA312A04970B2330D5666E6DC4338A2D5AE3E08C56C93EE915E6EE23DB35B39114DF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Revolverbnkes.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\undervisningscentrene\annuity\Revolverbnkes.ini
Size 534B
SHA256 fe643cb2a1d64d92b6f7fef19f953df9895c3d61df16ee7cfbdeec4a359fba97
MD5 2436e96a9d9c08bde961fa2bd1c99822
SHA1 7a4a8a5b0b5855eecc152b2bca2dcb3a8bf7737f
SHA512 7270aef734da1885f158df8a46570bfb2845b014c366d78ec2a0196270418606143c8d44b296f21cdc461f0dba73cec267b744fd06627b64c878f98582bf6630
TLSH
T116F005CBE86895278B07C358FDC05BC1B23AF38A150438CD96D106254D42DD9C37E62A
MD5 SHA1 SHA512 TLSH

Submit Download

Rundmundene.jpg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\undervisningscentrene\annuity\Rundmundene.jpg
Size 44KB
SHA256 47b9500d075fd8fda4f69a84e96895671c5a07ebcc866c89dd6cbf889adddebb
MD5 192aa46abf46fae3d1a28eb5195d70cb
SHA1 9bd3d7921a7289c86d43a6ad312ffcf5dec01967
SHA512 d2a7d115aee9ebd262feac068838499a7e753449335684b608325b13a8ca373107a244eb2bc743ea82dda55e1d509c37876a578a65ce388a7aea34bb4a25119c
SSDEEP 768:MGD5jvBJ+Y4LZiB0aoo6/Uvchx145a1mbpIxengMed1KAYC9EO8eodZO:MGD7Juoau6cvWcvbKxJM89YC9EO8nTO
TLSH
T18513F16D78682954E7C514BE48894818343846B07F2AE4DFE13F70ED6A48FF5EEC0078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leaviest.jpg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\undervisningscentrene\annuity\Tamburkorpsene\leaviest.jpg
Size 26KB
SHA256 a2fb08a672a0ae940793b798c6b21fdf78aaecebc0067d97527ed1593aac9ba5
MD5 bb4de54fe7bbcce50aa30de987cc4943
SHA1 dd9aa7069c13c843cdb17c8b65a3ee6754f3e191
SHA512 d6d68c6e5555b8c4dc20b5e39cdbf93abd35c994d5627ee3b3370383d85d36333ab5510fe8d7a01b1fa691f89d833f907cbf73cd4b176523475c42d03ac8b3e3
SSDEEP 768:l/o8yIXutTknOtu8hIZWQUynCBi2F8FP8SiycXVImTh:l/5z+dpt9oWQUzBVF8vitXNTh
TLSH
T124C2D10FF6071824BF0350CAB5342DC71C60DF56F6AB9270474599928DE9CB94BA7C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uncensurableness.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\undervisningscentrene\annuity\Uncensurableness.ini
Size 628B
SHA256 a801cf7932700f3288b81ae24026793cef5866d0d2140cd0950e4cb2baaf6133
MD5 13c0d0915a35a420c01932bdc149cbe5
SHA1 27322cd4bdb0a85e6bced4f4d5721d188f134710
SHA512 030f851eba7b230e57cffce203e2791856c205ce4b54668ceb135af27563e0aad6676bf5dee150dc2bf15ea9f6d08da3a14db402305ac2e0d2a10c172390a03a
TLSH
T130F002B1CEA0161C1CB11F41AD15A1F657BF552E4223A02A895F139D22824CCA59BD9D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3312-572-0x00000000747D5000-0x00000000747D6000-memory.dmp

Download

memory/4656-600-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/4656-589-0x0000000077AF1000-0x0000000077C11000-memory.dmp

Download

memory/4656-585-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/4656-575-0x0000000077B95000-0x0000000077B96000-memory.dmp

Download

memory/4656-574-0x0000000077C19000-0x0000000077C1A000-memory.dmp

Download

memory/4656-573-0x0000000077B78000-0x0000000077B79000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads