remcos | df5eb0acb2a459edb8483c8ad37aac0604267edadf41ca47a28bf003748e35f8

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 00:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Disgeneric.vbs
Size 95KB
Sample261109-a3kaysbe22
SHA256 df5eb0acb2a459edb8483c8ad37aac0604267edadf41ca47a28bf003748e35f8
MD5 160a2cd002b3f2c682d62cba5fa669dc
SHA1 1a9c1a35f1c2e61ca4245d4f96be9634f0750bd5
SHA512 482c7d5ebcb7aeaac6f89f107d3d1b015318cf5326020aa5c453331f6b500430dcb04c75e4545fc66e411e7f16bd22f472a2e5e4e703af26dd5fd44ff3a56dd8
SSDEEP 1536:1HNbqFudZVqQhVngplVA3HGGtu3nv9Ae5N3Xsv2C:1sodv/IOQf9AANg2C
TLSH
T154A33A51B9573915BD3A225798007DBD89FB70A5F31E0068EE98634C5006F7CF2EA2FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection defense_evasion discovery execution remcos privilege_escalation rat

Malware Config

Extracted

Family

remcos

Version

6.0.0 Pro

Botnet

RemoteHost

31.57.216.16:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0N9QNF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4388-54-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4764-50-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4500-49-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4500-49-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4764-50-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4684	powershell.exe
9	4684	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 8 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	backgroundtaskhost.exe

Accesses Microsoft Outlook profiles 1 TTPs 24 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
8	drive.google.com
11	drive.google.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2692	WScript.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4404	backgroundtaskhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4684	powershell.exe
4404	backgroundtaskhost.exe

Suspicious use of SetThreadContext 24 IoCs

description	pid	Process	procid_target
PID 4404 set thread context of 4764	4404	backgroundtaskhost.exe	96
PID 4404 set thread context of 4500	4404	backgroundtaskhost.exe	97
PID 4404 set thread context of 4388	4404	backgroundtaskhost.exe	98
PID 4404 set thread context of 1592	4404	backgroundtaskhost.exe	103
PID 4404 set thread context of 3560	4404	backgroundtaskhost.exe	104
PID 4404 set thread context of 2192	4404	backgroundtaskhost.exe	105
PID 4404 set thread context of 5840	4404	backgroundtaskhost.exe	109
PID 4404 set thread context of 3192	4404	backgroundtaskhost.exe	110
PID 4404 set thread context of 5988	4404	backgroundtaskhost.exe	112
PID 4404 set thread context of 4576	4404	backgroundtaskhost.exe	115
PID 4404 set thread context of 5920	4404	backgroundtaskhost.exe	116
PID 4404 set thread context of 5356	4404	backgroundtaskhost.exe	117
PID 4404 set thread context of 2424	4404	backgroundtaskhost.exe	120
PID 4404 set thread context of 2244	4404	backgroundtaskhost.exe	121
PID 4404 set thread context of 5884	4404	backgroundtaskhost.exe	122
PID 4404 set thread context of 4580	4404	backgroundtaskhost.exe	125
PID 4404 set thread context of 2776	4404	backgroundtaskhost.exe	126
PID 4404 set thread context of 6096	4404	backgroundtaskhost.exe	127
PID 4404 set thread context of 5960	4404	backgroundtaskhost.exe	130
PID 4404 set thread context of 4168	4404	backgroundtaskhost.exe	131
PID 4404 set thread context of 5776	4404	backgroundtaskhost.exe	132
PID 4404 set thread context of 2084	4404	backgroundtaskhost.exe	135
PID 4404 set thread context of 3212	4404	backgroundtaskhost.exe	136
PID 4404 set thread context of 4788	4404	backgroundtaskhost.exe	137

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5784	cmd.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3472	4764	WerFault.exe	96
6100	1592	WerFault.exe	103
4080	5840	WerFault.exe	109
4612	4576	WerFault.exe	115
5384	2424	WerFault.exe	120
4972	4580	WerFault.exe	125
4552	5960	WerFault.exe	130

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
4764	backgroundtaskhost.exe
4764	backgroundtaskhost.exe
4388	backgroundtaskhost.exe
4388	backgroundtaskhost.exe
1592	backgroundtaskhost.exe
1592	backgroundtaskhost.exe
2192	backgroundtaskhost.exe
2192	backgroundtaskhost.exe
5840	backgroundtaskhost.exe
5840	backgroundtaskhost.exe
5988	backgroundtaskhost.exe
5988	backgroundtaskhost.exe
4576	backgroundtaskhost.exe
4576	backgroundtaskhost.exe
5356	backgroundtaskhost.exe
5356	backgroundtaskhost.exe
2424	backgroundtaskhost.exe
2424	backgroundtaskhost.exe
5884	backgroundtaskhost.exe
5884	backgroundtaskhost.exe
4580	backgroundtaskhost.exe
4580	backgroundtaskhost.exe
6096	backgroundtaskhost.exe
6096	backgroundtaskhost.exe
5960	backgroundtaskhost.exe
5960	backgroundtaskhost.exe
5776	backgroundtaskhost.exe
5776	backgroundtaskhost.exe
2084	backgroundtaskhost.exe
2084	backgroundtaskhost.exe
4788	backgroundtaskhost.exe
4788	backgroundtaskhost.exe
2084	backgroundtaskhost.exe
2084	backgroundtaskhost.exe

Suspicious behavior: MapViewOfSection 1 TTPs 27 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4684	powershell.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe
4404	backgroundtaskhost.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	4388	backgroundtaskhost.exe
Token: SeDebugPrivilege	2192	backgroundtaskhost.exe
Token: SeDebugPrivilege	5988	backgroundtaskhost.exe
Token: SeDebugPrivilege	5356	backgroundtaskhost.exe
Token: SeDebugPrivilege	5884	backgroundtaskhost.exe
Token: SeDebugPrivilege	6096	backgroundtaskhost.exe
Token: SeDebugPrivilege	5776	backgroundtaskhost.exe
Token: SeDebugPrivilege	4788	backgroundtaskhost.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 5784	2692	WScript.exe	89
PID 5784 wrote to memory of 4520	5784	cmd.exe	91
PID 5784 wrote to memory of 4684	5784	cmd.exe	92
PID 4684 wrote to memory of 2876	4684	powershell.exe	93
PID 4684 wrote to memory of 4404	4684	powershell.exe	94
PID 4684 wrote to memory of 4404	4684	powershell.exe	94
PID 4404 wrote to memory of 260	4404	backgroundtaskhost.exe	95
PID 4404 wrote to memory of 4764	4404	backgroundtaskhost.exe	96
PID 4404 wrote to memory of 4500	4404	backgroundtaskhost.exe	97
PID 4404 wrote to memory of 4388	4404	backgroundtaskhost.exe	98
PID 4404 wrote to memory of 1592	4404	backgroundtaskhost.exe	103
PID 4404 wrote to memory of 3560	4404	backgroundtaskhost.exe	104
PID 4404 wrote to memory of 2192	4404	backgroundtaskhost.exe	105
PID 4404 wrote to memory of 3936	4404	backgroundtaskhost.exe	108
PID 4404 wrote to memory of 5840	4404	backgroundtaskhost.exe	109
PID 4404 wrote to memory of 3192	4404	backgroundtaskhost.exe	110
PID 4404 wrote to memory of 1376	4404	backgroundtaskhost.exe	111
PID 4404 wrote to memory of 5988	4404	backgroundtaskhost.exe	112
PID 4404 wrote to memory of 4576	4404	backgroundtaskhost.exe	115
PID 4404 wrote to memory of 5920	4404	backgroundtaskhost.exe	116
PID 4404 wrote to memory of 5356	4404	backgroundtaskhost.exe	117
PID 4404 wrote to memory of 2424	4404	backgroundtaskhost.exe	120
PID 4404 wrote to memory of 2244	4404	backgroundtaskhost.exe	121
PID 4404 wrote to memory of 5884	4404	backgroundtaskhost.exe	122
PID 4404 wrote to memory of 4580	4404	backgroundtaskhost.exe	125
PID 4404 wrote to memory of 2776	4404	backgroundtaskhost.exe	126
PID 4404 wrote to memory of 6096	4404	backgroundtaskhost.exe	127
PID 4404 wrote to memory of 5960	4404	backgroundtaskhost.exe	130
PID 4404 wrote to memory of 4168	4404	backgroundtaskhost.exe	131
PID 4404 wrote to memory of 5776	4404	backgroundtaskhost.exe	132
PID 4404 wrote to memory of 2084	4404	backgroundtaskhost.exe	135
PID 4404 wrote to memory of 3212	4404	backgroundtaskhost.exe	136
PID 4404 wrote to memory of 4788	4404	backgroundtaskhost.exe	137

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	backgroundtaskhost.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Disgeneric.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /q /v:on /c echo ^%Pintoes^% | !Rascacio! -
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo %Pintoes% "
    3⤵
    PID:4520
- - \??\c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -
    3⤵
    - Badlisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\backgroundtaskhost.exe
      "C:\Windows\SysWOW64\backgroundtaskhost.exe"
      4⤵
      PID:2876
  - - C:\Windows\SysWOW64\backgroundtaskhost.exe
      "C:\Windows\SysWOW64\backgroundtaskhost.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        "C:\Windows\SysWOW64\backgroundtaskhost.exe"
        5⤵
        
        PID:260
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\pviabn"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 576
        6⤵
        Program crash
        
        PID:3472
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\rpotugnlb"
        5⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:4500
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\brtmvyynphnxk"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\wypdzxszdesrwjxqlvmojkohfvthfxzu"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1592
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 236
        6⤵
        Program crash
        
        PID:6100
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\gauos"
        5⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:3560
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\juzgtiou"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\nebqyztzozygxlhiwfuwqpbyiiqusks"
        5⤵
        
        PID:3936
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\nebqyztzozygxlhiwfuwqpbyiiqusks"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5840
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 584
        6⤵
        Program crash
        
        PID:4080
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\ygojrrdachqlirvmfqhxbcwproavmviisv"
        5⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:3192
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\aattrk"
        5⤵
        
        PID:1376
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\aattrk"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5988
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\vphlwjagemmrwgoeqnhstqcgky"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 584
        6⤵
        Program crash
        
        PID:4612
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\fjudoblzsufwgmkizyulevoplngzg"
        5⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:5920
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\qlawptebgcxbjsymrjhnpijgutxihhbs"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5356
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\kawnuaqmbybvvtdssnvgf"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 236
        6⤵
        Program crash
        
        PID:5384
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\uubgmlbgphthfhzwbyhzinpx"
        5⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:2244
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\xxgqndmidplmhonikicbtakgosd"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5884
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\recirkgtrlpgtoso"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 584
        6⤵
        Program crash
        
        PID:4972
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\cghascrnfthkevgsvfd"
        5⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:2776
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\mantlvbotbzpgbcwmqppwtd"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6096
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\gpjkptoaoye"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 584
        6⤵
        Program crash
        
        PID:4552
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\jjovqmhtcgwvcq"
        5⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        
        PID:4168
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\tltojervqooaewqkgq"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5776
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\yvuyovoast"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2084
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\bpiqhozcgbcld"
        5⤵
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        outlook_office_path
        
        PID:3212
    - - C:\Windows\SysWOW64\backgroundtaskhost.exe
        
        C:\Windows\System32\backgroundtaskhost.exe /stext "C:\Users\Admin\AppData\Local\Temp\lrnbhgkvcjuqnytk"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4764 -ip 4764
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1592 -ip 1592
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5840 -ip 5840
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4576 -ip 4576
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2424 -ip 2424
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4580 -ip 4580
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5960 -ip 5960
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Debugger Evasion

T1622

Process Injection

T1055

Credential Access

Discovery

Debugger Evasion

T1622

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bhvCFF8.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhvCFF8.tmp
Size 14.0MB
SHA256 59a8fb586358c11022f86af119e94b9825167e6941bc08654a671e2231417f87
MD5 939d146271e991e60ec7a7ba3987fb6b
SHA1 c003723b55a58cd35749299f978db8649f012616
SHA512 7e3aeec64a65ad92ba491d5c193d12bd5d2447bf118def16c7ccaeee3cb41f08af0285de470cb8032e8abcc37ef403dfebc12ce4d1cc56e8809625386134583c
SSDEEP 3072:7buS+MCHDvOHpFkmAtJp/NBBy40ACSh0c7M0/Ppp/buS+MCHDvOHpF3pVylz5JW3:AgLgTttmntfg9tVgsmYqDkS4qy
TLSH
T16BE607CF4AD30E03FB221630A0E297532B77D5D153428B976979F5AB5F4A393AB42309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvuyovoast

Path C:\Users\Admin\AppData\Local\Temp\yvuyovoast
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4388-52-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4388-54-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4388-51-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4404-118-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4404-138-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4404-136-0x000000001EFC0000-0x000000001EFD9000-memory.dmp

Download

memory/4404-132-0x000000001EFC0000-0x000000001EFD9000-memory.dmp

Download

memory/4404-137-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4404-41-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4404-97-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4404-135-0x000000001EFC0000-0x000000001EFD9000-memory.dmp

Download

memory/4404-76-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4404-55-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4404-141-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4404-140-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4404-139-0x00000000004D0000-0x00000000017B6000-memory.dmp

Download

memory/4500-49-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4500-47-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4500-46-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4684-14-0x0000000007AD0000-0x000000000814C000-memory.dmp

Download

memory/4684-16-0x00000000075B0000-0x0000000007646000-memory.dmp

Download

memory/4684-25-0x0000000008CD0000-0x000000000C80C000-memory.dmp

Download

memory/4684-26-0x0000000074D10000-0x00000000754CC000-memory.dmp

Download

memory/4684-28-0x0000000074D10000-0x00000000754CC000-memory.dmp

Download

memory/4684-23-0x0000000074D10000-0x00000000754CC000-memory.dmp

Download

memory/4684-1-0x0000000002890000-0x00000000028C6000-memory.dmp

Download

memory/4684-22-0x0000000074D10000-0x00000000754CC000-memory.dmp

Download

memory/4684-21-0x0000000074D10000-0x00000000754CC000-memory.dmp

Download

memory/4684-20-0x0000000074D22000-0x0000000074D23000-memory.dmp

Download

memory/4684-19-0x0000000074D10000-0x00000000754CC000-memory.dmp

Download

memory/4684-2-0x0000000074D10000-0x00000000754CC000-memory.dmp

Download

memory/4684-18-0x0000000008710000-0x0000000008CCA000-memory.dmp

Download

memory/4684-4-0x0000000074D10000-0x00000000754CC000-memory.dmp

Download

memory/4684-17-0x0000000007550000-0x0000000007572000-memory.dmp

Download

memory/4684-24-0x0000000074D10000-0x00000000754CC000-memory.dmp

Download

memory/4684-15-0x0000000007470000-0x000000000748A000-memory.dmp

Download

memory/4684-0-0x0000000074D22000-0x0000000074D23000-memory.dmp

Download

memory/4684-13-0x0000000006690000-0x00000000066D8000-memory.dmp

Download

memory/4684-12-0x0000000006100000-0x000000000614C000-memory.dmp

Download

memory/4684-11-0x00000000060C0000-0x00000000060DE000-memory.dmp

Download

memory/4684-10-0x0000000005BF0000-0x0000000005F4B000-memory.dmp

Download

memory/4684-6-0x0000000005B10000-0x0000000005B76000-memory.dmp

Download

memory/4684-7-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Download

memory/4684-5-0x0000000005310000-0x0000000005332000-memory.dmp

Download

memory/4684-3-0x0000000005450000-0x0000000005A9A000-memory.dmp

Download

memory/4764-48-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4764-50-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4764-45-0x0000000000400000-0x0000000000478000-memory.dmp

Download