remcos | e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554

Analysis

max time kernel
60s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
Size 481KB
Sample260810-yvbwlsxcme
SHA256 e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554
MD5 899e1f862a9b39d5f0622011f7512dcb
SHA1 daf0e2f3c8bf3178adc3ee247cbd31be4a023667
SHA512 fde3651affbbaa73d431cfdbc12fd5ccc245da3d075a0520d7d7e1c99700ac0a37f6fab9699ce4e15646f245d829ad50a3c901aca9eb8bc9a3a635dce5d518c1
SSDEEP 12288:f13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQZS:Nak/mBXTV/R0nEF76gFZO
TLSH
T176A4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remcos rat suricata

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 8 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
7	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
7	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
2	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
7	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
7	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
7	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
11	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe

Suspicious use of SetThreadContext 30 IoCs

description	pid	Process	procid_target
PID 1308 set thread context of 2256	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	89
PID 1308 set thread context of 2264	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	90
PID 1308 set thread context of 1280	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	91
PID 1308 set thread context of 4296	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	92
PID 1308 set thread context of 3760	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	93
PID 1308 set thread context of 6020	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	94
PID 1308 set thread context of 2612	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	95
PID 1308 set thread context of 5048	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	96
PID 1308 set thread context of 4884	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	97
PID 1308 set thread context of 1668	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	98
PID 1308 set thread context of 5868	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	99
PID 1308 set thread context of 4632	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	100
PID 1308 set thread context of 3404	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	101
PID 1308 set thread context of 5632	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	102
PID 1308 set thread context of 1172	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	103
PID 1308 set thread context of 3944	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	104
PID 1308 set thread context of 1396	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	105
PID 1308 set thread context of 1164	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	106
PID 1308 set thread context of 5128	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	108
PID 1308 set thread context of 620	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	109
PID 1308 set thread context of 2788	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	110
PID 1308 set thread context of 2384	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	111
PID 1308 set thread context of 1904	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	112
PID 1308 set thread context of 1032	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	113
PID 1308 set thread context of 5972	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	114
PID 1308 set thread context of 1520	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	115
PID 1308 set thread context of 1404	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	116
PID 1308 set thread context of 1220	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	117
PID 1308 set thread context of 5640	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	118
PID 1308 set thread context of 4780	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	119

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe

Suspicious behavior: MapViewOfSection 30 IoCs

pid	Process
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2256	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	89
PID 1308 wrote to memory of 2264	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	90
PID 1308 wrote to memory of 1280	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	91
PID 1308 wrote to memory of 4296	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	92
PID 1308 wrote to memory of 3760	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	93
PID 1308 wrote to memory of 6020	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	94
PID 1308 wrote to memory of 2612	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	95
PID 1308 wrote to memory of 5048	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	96
PID 1308 wrote to memory of 4884	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	97
PID 1308 wrote to memory of 1668	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	98
PID 1308 wrote to memory of 5868	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	99
PID 1308 wrote to memory of 4632	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	100
PID 1308 wrote to memory of 3404	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	101
PID 1308 wrote to memory of 5632	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	102
PID 1308 wrote to memory of 1172	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	103
PID 1308 wrote to memory of 3944	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	104
PID 1308 wrote to memory of 1396	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	105
PID 1308 wrote to memory of 1164	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	106
PID 1308 wrote to memory of 5128	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	108
PID 1308 wrote to memory of 620	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	109
PID 1308 wrote to memory of 2788	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	110
PID 1308 wrote to memory of 2384	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	111
PID 1308 wrote to memory of 1904	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	112
PID 1308 wrote to memory of 1032	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	113
PID 1308 wrote to memory of 5972	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	114
PID 1308 wrote to memory of 1520	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	115
PID 1308 wrote to memory of 1404	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	116
PID 1308 wrote to memory of 1220	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	117
PID 1308 wrote to memory of 5640	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	118
PID 1308 wrote to memory of 4780	1308	e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe	119

C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
"C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe"
1⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\mhiw"
  2⤵
  PID:2256
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\ojohdnqu"
  2⤵
  PID:2264
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\zdtzegbwdvd"
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\tsprjevazshndgxwuhokqhbnqgdfqc"
  2⤵
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\dmujjxgbnazagmlaesbetuwwrnnojnvulk"
  2⤵
  PID:3760
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\oohccp"
  2⤵
  PID:6020
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\idvtgwdgoewycuekopbyuiunkf"
  2⤵
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\lxbehpoicmodeiawfzoawnoetltsd"
  2⤵
  PID:5048
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\vaoxazybqughoooapkjthajnusktezoe"
  2⤵
  PID:4884
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\phcoegtnmrkbaptgqopmx"
  2⤵
  PID:1668
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\ajphfyepazcodvpkzzjoafhe"
  2⤵
  PID:5868
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\cdvryroiohusnjdoqkwplscvwqq"
  2⤵
  PID:4632
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\hmwbditvpmqrbqvybhx"
  2⤵
  PID:3404
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\sobueaepduidmwskkskeol"
  2⤵
  PID:5632
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\ujgmwtpqzcaiodgobcwxzypmzv"
  2⤵
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\oycebrbcnzfcae"
  2⤵
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\zsiobkuwbhxgksgymr"
  2⤵
  PID:1396
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\junhucfxppptnyucvcstd"
  2⤵
  PID:1164
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\ejjyybrjc"
  2⤵
  PID:5128
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\gdorztccqtlrj"
  2⤵
  PID:620
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\qftksmmemcdwltjy"
  2⤵
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\lmpbw"
  2⤵
  PID:2384
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\vovmxlrj"
  2⤵
  PID:1904
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\yjieydclcos"
  2⤵
  PID:1032
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\aywwucxwplwbwhusswgoikntstzqwob"
  2⤵
  PID:5972
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\dsbovvhqdtofgwqwbhtqkxikbarzyzsnuq"
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\nuohwn"
  2⤵
  PID:1404
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\hjcysmednykeudjomwucldgbvs"
  2⤵
  PID:1220
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\sdqjtepwbgcqfjfsdggeoqakvyxvs"
  2⤵
  PID:5640
- C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe
  C:\Users\Admin\AppData\Local\Temp\e361e0ed13887b948809b6a88bc3464d648cac54e73aa431a1c8e3751e268554.exe /stext "C:\Users\Admin\AppData\Local\Temp\uxvbtxiyoouvhptwmrbxzvvbefgellkp"
  2⤵
  PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-10-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1308-83-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1308-86-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1308-87-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1308-88-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1308-89-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/2256-3-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2264-7-0x0000000000400000-0x0000000000462000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads